auth0-express by auth0/agent-skills
npx skills add https://github.com/auth0/agent-skills --skill auth0-express使用 express-openid-connect 为 Express.js Web 应用程序添加身份验证。
auth0-quickstart 技能auth0-react、auth0-vue 或 auth0-angularauth0-nextjs 技能,它同时处理客户端和服务器端auth0-react-native广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
npm install express-openid-connect dotenv
要使用 Auth0 CLI 进行自动化设置,请参阅设置指南获取完整脚本。
对于手动设置:
创建 .env 文件:
SECRET=<openssl-rand-hex-32>
BASE_URL=http://localhost:3000
CLIENT_ID=your-client-id
CLIENT_SECRET=your-client-secret
ISSUER_BASE_URL=https://your-tenant.auth0.com
生成密钥:openssl rand -hex 32
更新您的 Express 应用(app.js 或 index.js):
require('dotenv').config();
const express = require('express');
const { auth, requiresAuth } = require('express-openid-connect');
const app = express();
// 配置 Auth0 中间件
app.use(auth({
authRequired: false, // 不要求所有路由都进行身份验证
auth0Logout: true, // 启用注销端点
secret: process.env.SECRET,
baseURL: process.env.BASE_URL,
clientID: process.env.CLIENT_ID,
issuerBaseURL: process.env.ISSUER_BASE_URL,
clientSecret: process.env.CLIENT_SECRET
}));
app.listen(3000, () => {
console.log('Server running on http://localhost:3000');
});
这将自动创建:
/login - 登录端点/logout - 注销端点/callback - OAuth 回调端点// 公共路由
app.get('/', (req, res) => {
res.send(req.oidc.isAuthenticated() ? '已登录' : '已注销');
});
// 受保护的路由
app.get('/profile', requiresAuth(), (req, res) => {
res.send(`
<h1>个人资料</h1>
<p>姓名:${req.oidc.user.name}</p>
<p>邮箱:${req.oidc.user.email}</p>
<pre>${JSON.stringify(req.oidc.user, null, 2)}</pre>
<a href="/logout">注销</a>
`);
});
// 登录/注销链接
app.get('/', (req, res) => {
res.send(`
${req.oidc.isAuthenticated() ? `
<p>欢迎,${req.oidc.user.name}!</p>
<a href="/profile">个人资料</a>
<a href="/logout">注销</a>
` : `
<a href="/login">登录</a>
`}
`);
});
启动您的服务器:
node app.js
访问 http://localhost:3000 并测试登录流程。
| 错误 | 修复方法 |
|---|---|
| 忘记在 Auth0 仪表板中添加回调 URL | 将 /callback 路径添加到允许的回调 URL(例如,http://localhost:3000/callback) |
| 缺少或密钥强度不足 | 使用 openssl rand -hex 32 生成安全密钥,并存储在 .env 文件中作为 SECRET |
全局设置 authRequired: true | 设置为 false,并在特定路由上使用 requiresAuth() 中间件 |
| 在 Auth0 中创建为 SPA 类型 | 对于服务器端身份验证,必须是常规 Web 应用程序类型 |
| 会话密钥在代码中暴露 | 始终使用环境变量,切勿硬编码密钥 |
| 生产环境的 baseURL 错误 | 将 BASE_URL 更新为匹配您的生产域名 |
| 未处理注销返回地址 | 在 Auth0 仪表板的允许注销 URL 中添加您的域名 |
auth0-quickstart - 基础 Auth0 设置auth0-migration - 从其他身份验证提供商迁移auth0-mfa - 添加多因素身份验证中间件选项:
authRequired - 要求所有路由进行身份验证(默认:false)auth0Logout - 启用 /logout 端点(默认:false)secret - 会话密钥(必需)baseURL - 应用程序 URL(必需)clientID - Auth0 客户端 ID(必需)issuerBaseURL - Auth0 租户 URL(必需)请求属性:
req.oidc.isAuthenticated() - 检查用户是否已登录req.oidc.user - 用户资料对象req.oidc.accessToken - 用于 API 调用的访问令牌req.oidc.idToken - ID 令牌req.oidc.refreshToken - 刷新令牌常见用例:
requiresAuth() 中间件(参见步骤 4)req.oidc.isAuthenticated()req.oidc.user每周安装量
80
仓库
GitHub 星标数
11
首次出现
2026年2月6日
安全审计
安装于
opencode72
codex71
github-copilot70
gemini-cli69
amp66
kimi-cli66
Add authentication to Express.js web applications using express-openid-connect.
auth0-quickstart skill firstauth0-react, auth0-vue, or auth0-angular for client-side authauth0-nextjs skill which handles both client and serverauth0-react-native for React Native/Exponpm install express-openid-connect dotenv
For automated setup with Auth0 CLI , see Setup Guide for complete scripts.
For manual setup:
Create .env:
SECRET=<openssl-rand-hex-32>
BASE_URL=http://localhost:3000
CLIENT_ID=your-client-id
CLIENT_SECRET=your-client-secret
ISSUER_BASE_URL=https://your-tenant.auth0.com
Generate secret: openssl rand -hex 32
Update your Express app (app.js or index.js):
require('dotenv').config();
const express = require('express');
const { auth, requiresAuth } = require('express-openid-connect');
const app = express();
// Configure Auth0 middleware
app.use(auth({
authRequired: false, // Don't require auth for all routes
auth0Logout: true, // Enable logout endpoint
secret: process.env.SECRET,
baseURL: process.env.BASE_URL,
clientID: process.env.CLIENT_ID,
issuerBaseURL: process.env.ISSUER_BASE_URL,
clientSecret: process.env.CLIENT_SECRET
}));
app.listen(3000, () => {
console.log('Server running on http://localhost:3000');
});
This automatically creates:
/login - Login endpoint/logout - Logout endpoint/callback - OAuth callback// Public route
app.get('/', (req, res) => {
res.send(req.oidc.isAuthenticated() ? 'Logged in' : 'Logged out');
});
// Protected route
app.get('/profile', requiresAuth(), (req, res) => {
res.send(`
<h1>Profile</h1>
<p>Name: ${req.oidc.user.name}</p>
<p>Email: ${req.oidc.user.email}</p>
<pre>${JSON.stringify(req.oidc.user, null, 2)}</pre>
<a href="/logout">Logout</a>
`);
});
// Login/logout links
app.get('/', (req, res) => {
res.send(`
${req.oidc.isAuthenticated() ? `
<p>Welcome, ${req.oidc.user.name}!</p>
<a href="/profile">Profile</a>
<a href="/logout">Logout</a>
` : `
<a href="/login">Login</a>
`}
`);
});
Start your server:
node app.js
Visit http://localhost:3000 and test the login flow.
| Mistake | Fix |
|---|---|
| Forgot to add callback URL in Auth0 Dashboard | Add /callback path to Allowed Callback URLs (e.g., http://localhost:3000/callback) |
| Missing or weak SECRET | Generate secure secret with openssl rand -hex 32 and store in .env as SECRET |
| Setting authRequired: true globally | Set to false and use requiresAuth() middleware on specific routes |
| App created as SPA type in Auth0 | Must be Regular Web Application type for server-side auth |
| Session secret exposed in code | Always use environment variables, never hardcode secrets |
| Wrong baseURL for production |
auth0-quickstart - Basic Auth0 setupauth0-migration - Migrate from another auth providerauth0-mfa - Add Multi-Factor AuthenticationMiddleware Options:
authRequired - Require auth for all routes (default: false)auth0Logout - Enable /logout endpoint (default: false)secret - Session secret (required)baseURL - Application URL (required)clientID - Auth0 client ID (required)issuerBaseURL - Auth0 tenant URL (required)Request Properties:
req.oidc.isAuthenticated() - Check if user is logged inreq.oidc.user - User profile objectreq.oidc.accessToken - Access token for API callsreq.oidc.idToken - ID tokenreq.oidc.refreshToken - Refresh tokenCommon Use Cases:
requiresAuth() middleware (see Step 4)req.oidc.isAuthenticated()req.oidc.userWeekly Installs
80
Repository
GitHub Stars
11
First Seen
Feb 6, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
opencode72
codex71
github-copilot70
gemini-cli69
amp66
kimi-cli66
Linux云主机安全托管指南:从SSH加固到HTTPS部署
46,900 周安装
| Update BASE_URL to match your production domain |
| Not handling logout returnTo | Add your domain to Allowed Logout URLs in Auth0 Dashboard |