Lightweight library to verify AzureAD JSON Web Tokens.
It weights around 12KB alone and less than 320KB with its only one dependeny: jsonwebtoken
Other libraries generally includes
request and are bloated. I decided to write this lib because the previous helper I used weighted more than 4MB with all its dependencies!
Futhermore, it is written in typescript and provide its own type definitions.
Last but not least, it is unit tested with one-hundred percent test coverage.
Install the package using yarn or NPM:
npm i azure-ad-jwt-lite
Do not forget to install
jsonwebtoken types definitions as dev dependency if you are using Typescript:
npm i -D @types/jsonwebtoken.
In your authentication middleware decode and verify the token using:
You can add any option supported by jsonwebtoken:
Discovery URL: The URL to fetch Microsoft public keys (defaults to https://login.microsoftonline.com/common/discovery/keys)
Retries on 5xx: set the number of retries when request to fetch keys returns a 5xx response (defaults to 2)
The lib will throw the following errors if something wrong happends during decoding token:
InvalidToken: the token provided is not a non-empty string.
TokenNotDecoded: the token cannot be decoded. This usually means the token is ill-formed.
kid(Microsoft Key ID) field is present in JWT header.
ErrorFetchingKeys: API call to fetch Microsoft public keys failed.
NotMatchingKey: no matching key is found in Microsoft response.
JsonWebTokenError: token cannot be verified, the human-readable reason is provided (expired, audience mismatch etc...)