notes.dt.in.th

Quickly protecting an Express HTTP server with GitHub authentication via Auth0.

  1. Set up an Auth0 tenant, create a web application, and then follow the Quick Start for Node.js tutorial.

    After you complete the tutorial, you will get a usable express-openid-connect config.

  2. The tutorial suggests you to use authRequired: false. Change that to true.

  3. Also add session: { cookie: { secure: true } }, to config to make sure cookie is Secure and never sent unencrypted.

  4. Allow single user by using the claimEquals endpoint by checking against the sub (subject) claim of the JWT:

    const { claimEquals } = require('express-openid-connect')
    app.use(claimEquals('sub', 'github|193136'))

    You can obtain the sub value by going to the Users section inside Auth0 control panel, and copy out the id.