OAuth 2.0 and OpenID Connect: signing in with another account

// PKCE S256 by hand (RFC 7636, section 4): verifier -> SHA-256 -> base64url.
import { createHash, randomBytes } from "node:crypto";

export function createVerifier() {
  return randomBytes(32).toString("base64url"); // 43 characters, allowed range is 43–128
}

export function challengeS256(verifier) {
  return createHash("sha256").update(verifier, "ascii").digest("base64url");
}

// Test vector from RFC 7636, Appendix B
const verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
console.log(challengeS256(verifier));
console.log(challengeS256(verifier) === "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM");
console.log(createVerifier().length);

$ node pkce.mjs
E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
true
43

// Server-to-server: a background worker gets its own token, no user involved.
import * as client from "openid-client";

const config = await client.discovery(
  new URL(process.env.OIDC_ISSUER),
  process.env.WORKER_CLIENT_ID,
  process.env.WORKER_CLIENT_SECRET,
  undefined,
  { execute: [client.allowInsecureRequests] }, // test IdP on http://localhost only
);

const tokens = await client.clientCredentialsGrant(config, { scope: "reports:read" });
console.log({ token_type: tokens.token_type, expires_in: tokens.expiresIn(), scope: tokens.scope, id_token: tokens.id_token });

$ node --env-file=.env client-credentials.mjs
{
  token_type: 'bearer',
  expires_in: 600,
  scope: 'reports:read',
  id_token: undefined
}

$ curl -s http://localhost:4100/.well-known/openid-configuration
{
  "issuer": "http://localhost:4100",
  "authorization_endpoint": "http://localhost:4100/auth",
  "token_endpoint": "http://localhost:4100/token",
  "userinfo_endpoint": "http://localhost:4100/me",
  "jwks_uri": "http://localhost:4100/jwks",
  "code_challenge_methods_supported": ["S256"],
  "grant_types_supported": ["implicit", "authorization_code", "refresh_token", "client_credentials"],
  "id_token_signing_alg_values_supported": ["RS256"],
  "authorization_response_iss_parameter_supported": true,
  …
}

mkdir oidc-stand && cd oidc-stand
npm init -y
npm install openid-client@6.8.8 oidc-provider@9.12.2 jose@6.2.12

// Test identity provider for local development only: in-memory storage,
// built-in dev login form, keys generated on every start.
import { generateKeyPairSync } from "node:crypto";
import Provider from "oidc-provider";

const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });

const users = {
  "aigerim": { sub: "aigerim", name: "Aigerim Test", email: "aigerim@example.test", email_verified: true },
};

const provider = new Provider("http://localhost:4100", {
  clients: [
    {
      client_id: "interlab-web",
      client_secret: "test-secret-change-me",
      redirect_uris: ["http://localhost:4200/callback"],
      grant_types: ["authorization_code", "refresh_token"],
    },
    {
      client_id: "reports-worker",
      client_secret: "test-worker-secret",
      grant_types: ["client_credentials"],
      redirect_uris: [],
      response_types: [],
      scope: "reports:read",
    },
  ],
  jwks: { keys: [{ ...privateKey.export({ format: "jwk" }), kid: "test-key-1", use: "sig", alg: "RS256" }] },
  cookies: { keys: ["test-cookie-key-change-me"] },
  pkce: { required: () => true },
  scopes: ["openid", "profile", "email", "offline_access", "reports:read", "reports:write"],
  claims: { openid: ["sub"], profile: ["name"], email: ["email", "email_verified"] },
  features: { clientCredentials: { enabled: true } },
  ttl: { AccessToken: 600, IdToken: 600, AuthorizationCode: 60, ClientCredentials: 600, RefreshToken: 86400, Interaction: 600, Session: 3600, Grant: 86400 },
  async findAccount(ctx, id) {
    const user = users[id];
    if (!user) return undefined;
    return { accountId: id, async claims() { return user; } };
  },
});

provider.listen(4100, () => {
  console.log("IdP: http://localhost:4100/.well-known/openid-configuration");
});

OIDC_ISSUER=http://localhost:4100
OIDC_CLIENT_ID=interlab-web
OIDC_CLIENT_SECRET=test-secret-change-me
WORKER_CLIENT_ID=reports-worker
WORKER_CLIENT_SECRET=test-worker-secret

// Relying party (the client): sign-in through an external provider.
// Run: node --env-file=.env app.mjs, then open http://localhost:4200/login
import { randomBytes } from "node:crypto";
import { createServer } from "node:http";
import * as client from "openid-client";

const REDIRECT_URI = "http://localhost:4200/callback";

// Discovery: endpoints and keys come from /.well-known/openid-configuration.
// allowInsecureRequests only because the test IdP runs on http://localhost.
const config = await client.discovery(
  new URL(process.env.OIDC_ISSUER),
  process.env.OIDC_CLIENT_ID,
  process.env.OIDC_CLIENT_SECRET,
  undefined,
  { execute: [client.allowInsecureRequests] },
);

// Pending sign-ins: transaction id -> PKCE verifier, state, nonce.
// In production keep this in the server-side session store, not in memory.
const pending = new Map();

function readCookie(req, name) {
  const pair = (req.headers.cookie ?? "").split("; ").find((c) => c.startsWith(`${name}=`));
  return pair?.slice(name.length + 1);
}

async function login(res) {
  const codeVerifier = client.randomPKCECodeVerifier();
  const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
  const state = client.randomState();
  const nonce = client.randomNonce();
  const tx = randomBytes(16).toString("base64url");
  pending.set(tx, { codeVerifier, state, nonce });

  const url = client.buildAuthorizationUrl(config, {
    redirect_uri: REDIRECT_URI,
    scope: "openid profile email",
    code_challenge: codeChallenge,
    code_challenge_method: "S256",
    state,
    nonce,
  });
  // SameSite=Lax: the cookie is sent when the provider redirects the browser back (top-level GET).
  res.writeHead(302, {
    location: url.href,
    "set-cookie": `oidc_tx=${tx}; HttpOnly; SameSite=Lax; Path=/callback; Max-Age=600`,
  });
  res.end();
}

async function callback(req, res, currentUrl) {
  const tx = readCookie(req, "oidc_tx");
  const checks = tx && pending.get(tx);
  if (!checks) {
    res.writeHead(400).end("Unknown or expired sign-in attempt");
    return;
  }
  pending.delete(tx); // one attempt — one use

  // Checks iss in the response, state, exchanges code + code_verifier,
  // validates the ID token: iss, aud, exp, iat, nonce.
  const tokens = await client.authorizationCodeGrant(config, currentUrl, {
    pkceCodeVerifier: checks.codeVerifier,
    expectedState: checks.state,
    expectedNonce: checks.nonce,
  });
  const idToken = tokens.claims();
  // UserInfo is accepted only if its sub matches the ID token's sub.
  const profile = await client.fetchUserInfo(config, tokens.access_token, idToken.sub);

  console.log("token response:", {
    token_type: tokens.token_type,
    expires_in: tokens.expiresIn(),
    scope: tokens.scope,
    has_refresh_token: Boolean(tokens.refresh_token),
  });
  console.log("ID token claims:", idToken);
  console.log("UserInfo:", profile);

  // Stable user key = iss + sub (not email). Next step: create your own session.
  res.writeHead(200, { "content-type": "text/plain; charset=utf-8", "set-cookie": "oidc_tx=; Path=/callback; Max-Age=0" });
  res.end(`Signed in: ${idToken.iss} / ${idToken.sub} (${profile.name})`);
}

createServer(async (req, res) => {
  const url = new URL(req.url, "http://localhost:4200");
  try {
    if (url.pathname === "/login") return await login(res);
    if (url.pathname === "/callback") return await callback(req, res, url);
    res.writeHead(404).end();
  } catch (err) {
    console.error("sign-in failed:", err.name, err.code ?? "", err.message);
    res.writeHead(400).end("Sign-in failed");
  }
}).listen(4200, () => console.log("App: http://localhost:4200/login"));

302 GET  http://localhost:4200/login
303 GET  http://localhost:4100/auth?redirect_uri=http%3A%2F%2Flocalhost%3A4200%2Fcallback&scope=openid+profile+email&code_challenge=…&code_challenge_method=S256&state=…&nonce=…&client_id=interlab-web&response_type=code
200 GET  http://localhost:4100/interaction/rJBqRAwenOqCqEBf1z3I_h0OWVqZlzE3jj9MnzNQYRN
303 POST http://localhost:4100/interaction/rJBqRAwenOqCqEBf1z3I_h0OWVqZlzE3jj9MnzNQYRN
303 GET  http://localhost:4100/auth/rJBqRAwenOqCqEBf1z3I_h0OWVqZlzE3jj9MnzNQYRN
200 GET  http://localhost:4100/interaction/bSwi-VlD7oDKJ1I4g6ZjNDzuc8L2B6Wd_a2StkjfvEk
303 POST http://localhost:4100/interaction/bSwi-VlD7oDKJ1I4g6ZjNDzuc8L2B6Wd_a2StkjfvEk
303 GET  http://localhost:4100/auth/bSwi-VlD7oDKJ1I4g6ZjNDzuc8L2B6Wd_a2StkjfvEk
200 GET  http://localhost:4200/callback?code=…&state=…&iss=http%3A%2F%2Flocalhost%3A4100

$ node provider.mjs
oidc-provider WARNING: a quick start development-only in-memory adapter is used, you MUST change it in order to not lose all stateful provider data upon restart and to be able to share these between processes
oidc-provider WARNING: a quick start development-only feature devInteractions is enabled, you are expected to disable these interactions and provide your own
IdP: http://localhost:4100/.well-known/openid-configuration

$ node --env-file=.env app.mjs
App: http://localhost:4200/login
token response: {
  token_type: 'bearer',
  expires_in: 599,
  scope: 'openid profile email',
  has_refresh_token: false
}
ID token claims: {
  sub: 'aigerim',
  nonce: '-LzAqMKyjMJKsyDq5VUnxw_j__msNftg7EGno4Fsg-k',
  aud: 'interlab-web',
  exp: 1791774176,
  iat: 1791773576,
  iss: 'http://localhost:4100'
}
UserInfo: {
  sub: 'aigerim',
  name: 'Aigerim Test',
  email: 'aigerim@example.test',
  email_verified: true
}

// Full ID token check when the token did NOT come straight from the token endpoint,
// e.g. a mobile app sends it to your API. OpenID Connect Core 1.0, section 3.1.3.7.
import { createRemoteJWKSet, jwtVerify } from "jose";

const jwksCache = new Map();

export async function verifyIdToken(idToken, { issuer, jwksUri, clientId, nonce }) {
  if (!jwksCache.has(jwksUri)) jwksCache.set(jwksUri, createRemoteJWKSet(new URL(jwksUri)));
  const { payload } = await jwtVerify(idToken, jwksCache.get(jwksUri), {
    issuer, // iss must match exactly
    audience: clientId, // aud must contain our client_id
    algorithms: ["RS256"], // only what we expect; never "none"
    requiredClaims: ["sub", "iat", "exp"],
    maxTokenAge: "10m", // reject tokens issued too long ago (iat)
    clockTolerance: 30, // seconds of clock skew allowed for exp/iat
  });
  if (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== clientId) {
    throw new Error("unexpected extra audiences");
  }
  if (payload.nonce !== nonce) throw new Error("nonce mismatch");
  return payload;
}

$ node --test negative.test.mjs idtoken.test.mjs
  valid -> aigerim interlab-web
  forged sub -> ERR_JWS_SIGNATURE_VERIFICATION_FAILED
  other aud -> ERR_JWT_CLAIM_VALIDATION_FAILED aud
  nonce -> nonce mismatch
  alg none -> ERR_JOSE_ALG_NOT_ALLOWED
✔ ID token: valid passes, tampered / foreign aud / wrong nonce fail (119.2465ms)
  -> invalid_scope requested scope is not allowed
  -> invalid_client client authentication failed
✔ client credentials: scope outside the client's allowance is refused (28.9577ms)
✔ happy path returns an ID token for aigerim (86.1297ms)
  -> ResponseBodyError invalid_grant grant request is invalid
✔ wrong code_verifier: the IdP refuses the code (PKCE) (114.0837ms)
  -> ClientError OAUTH_INVALID_RESPONSE invalid response encountered
✔ state from another attempt is rejected before the token request (95.1324ms)
  -> ClientError OAUTH_JWT_CLAIM_COMPARISON_FAILED unexpected JWT claim value encountered
✔ unexpected nonce is rejected (109.1164ms)
  -> ResponseBodyError invalid_grant grant request is invalid
✔ the same code cannot be used twice (122.6895ms)
  -> 303 invalid_request Authorization Server policy requires PKCE to be used for this request
✔ authorization request without PKCE is refused by the IdP (2.7214ms)
  -> 400 null
✔ redirect_uri not registered: the IdP does not redirect at all (11.6301ms)
ℹ tests 9
ℹ pass 9
ℹ fail 0