oauth2-server

The oauth2-server module provides a complete, RFC 6749 and RFC 6750 compliant implementation for Node.js.

Key features include:

• Supported Grant Types: authorization_code, client_credentials, refresh_token, password, and extension grants with scopes.
• Asynchronous Support: Compatible with Promises, Node-style callbacks, ES6 generators, and async/await (via Babel).
• Storage Agnostic: Can be used with any storage backend such as PostgreSQL, MySQL, MongoDB, or Redis.
• Framework Agnostic: While it can be used directly, official wrappers exist for Express and Koa.

The oauth2-server module is framework-agnostic and is typically used through an adapter that converts its interface to work with specific HTTP server frameworks. For popular frameworks, use the following officially supported adapters:

• Express: Use express-oauth-server.
• Koa: Use koa-oauth-server.

To run the project's test suite, install the dependencies first and then execute the test command.

npm install
npm test

When defining your model object for OAuth2Server, each function can support several asynchronous patterns. The library handles Promises, Node-style callbacks, ES6 generators, and async/await (via Babel). Note that returning a plain value is also supported if asynchronism is not required.

const model = {
  // Support returning promises
  getAccessToken: function() {
    return new Promise((resolve, reject) => resolve('works!'));
  },

  // Or, calling a Node-style callback
  getAuthorizationCode: function(done) {
    done(null, 'works!');
  },

  // Or, using generators
  getClient: function*() {
    yield somethingAsync();
    return 'works!';
  },

  // Or, async/await (using Babel)
  getUser: async function() {
    await somethingAsync();
    return 'works!';
  }
};

const OAuth2Server = require('oauth2-server');
let oauth = new OAuth2Server({model: model});

Install the oauth2-server module using npm to implement an OAuth2 server in Node.js. The module is framework-agnostic, but if you are using Express or Koa, it is recommended to use their respective official wrappers (express-oauth-server or koa-oauth-server) instead of using this module directly.

npm install oauth2-server

When upgrading to oauth2-server v3.x, the middleware names have been updated to align more closely with the OAuth2 RFC. Update your middleware references as follows:

Note that errorHandler and lockdown have been removed in v3.x. Errors are now handled by external wrappers, and lockdown (which was specific to Express) is no longer provided.

To create a custom adapter, you must bridge the gap between the oauth2-server core and your specific HTTP framework.

An adapter should:

1. Inherit from OAuth2Server.
2. Override the following methods:
   • authenticate()
   • authorize()
   • token()

For each overridden method, you must:

• Create Request and Response objects from your framework's specific request/response objects.
• Call the original OAuth2Server function.
• Copy all fields from the oauth2-server Response object back to your framework-specific response object and send it.