Auth0 Express 集成指南：为 Express.js 应用快速添加身份验证

auth0-express by auth0/agent-skills

213 周安装量

14 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/auth0/agent-skills --skill auth0-express

Node.js API 安全

🇨🇳中文介绍

Auth0 Express 集成

使用 express-openid-connect 为 Express.js Web 应用程序添加身份验证。

先决条件

Express.js 应用程序
已配置的 Auth0 账户和应用程序
如果您尚未设置 Auth0，请先使用 auth0-quickstart 技能

何时不应使用

单页应用程序 - 对于客户端身份验证，请使用 auth0-react、auth0-vue 或 auth0-angular
Next.js 应用程序 - 使用 auth0-nextjs 技能，它同时处理客户端和服务器端
移动应用程序 - 对于 React Native/Expo，请使用 auth0-react-native
无状态 API - 使用 JWT 验证中间件，而不是基于会话的身份验证

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

相关 Skills

FlyClaw：零登录航班聚合查询工具，Python实现多源航班信息与价格搜索

4,000,000 周安装

Azure RBAC 权限管理工具：查找最小角色、创建自定义角色与自动化分配

142,000 周安装

SoulTrace 人格评估 API - 基于五色心理模型的贝叶斯自适应测试

50,400 周安装

OpenClaw 安全 Linux 云部署指南：私有优先、SSH隧道、Podman容器化

47,000 周安装

require('dotenv').config();
const express = require('express');
const { auth, requiresAuth } = require('express-openid-connect');

const app = express();

// 配置 Auth0 中间件
app.use(auth({
  authRequired: false,  // 不要求所有路由都进行身份验证
  auth0Logout: true,    // 启用注销端点
  secret: process.env.SECRET,
  baseURL: process.env.BASE_URL,
  clientID: process.env.CLIENT_ID,
  issuerBaseURL: process.env.ISSUER_BASE_URL,
  clientSecret: process.env.CLIENT_SECRET
}));

app.listen(3000, () => {
  console.log('Server running on http://localhost:3000');
});

// 公共路由
app.get('/', (req, res) => {
  res.send(req.oidc.isAuthenticated() ? '已登录' : '已注销');
});

// 受保护的路由
app.get('/profile', requiresAuth(), (req, res) => {
  res.send(`
    <h1>个人资料</h1>
    <p>姓名：${req.oidc.user.name}</p>
    <p>邮箱：${req.oidc.user.email}</p>
    <pre>${JSON.stringify(req.oidc.user, null, 2)}</pre>
    <a href="/logout">注销</a>
  `);
});

// 登录/注销链接
app.get('/', (req, res) => {
  res.send(`
    ${req.oidc.isAuthenticated() ? `
      <p>欢迎，${req.oidc.user.name}！</p>
      <a href="/profile">个人资料</a>
      <a href="/logout">注销</a>
    ` : `
      <a href="/login">登录</a>
    `}
  `);
});

错误	修复方法
忘记在 Auth0 仪表板中添加回调 URL	将 `/callback` 路径添加到允许的回调 URL（例如，`http://localhost:3000/callback`）
缺少或密钥强度不足	使用 `openssl rand -hex 32` 生成安全密钥，并存储在 .env 文件中作为 `SECRET`
全局设置 `authRequired: true`	设置为 `false`，并在特定路由上使用 `requiresAuth()` 中间件
在 Auth0 中创建为 SPA 类型	对于服务器端身份验证，必须是常规 Web 应用程序类型
会话密钥在代码中暴露	始终使用环境变量，切勿硬编码密钥
生产环境的 baseURL 错误	将 BASE_URL 更新为匹配您的生产域名
未处理注销返回地址	在 Auth0 仪表板的允许注销 URL 中添加您的域名

authRequired - 要求所有路由进行身份验证（默认：false）
auth0Logout - 启用 /logout 端点（默认：false）
secret - 会话密钥（必需）
baseURL - 应用程序 URL（必需）
clientID - Auth0 客户端 ID（必需）
issuerBaseURL - Auth0 租户 URL（必需）

req.oidc.isAuthenticated() - 检查用户是否已登录
req.oidc.user - 用户资料对象
req.oidc.accessToken - 用于 API 调用的访问令牌
req.oidc.idToken - ID 令牌
req.oidc.refreshToken - 刷新令牌

🇺🇸English

Auth0 Express Integration

Add authentication to Express.js web applications using express-openid-connect.

Prerequisites

Express.js application
Auth0 account and application configured
If you don't have Auth0 set up yet, use the auth0-quickstart skill first

When NOT to Use

Single Page Applications - Use auth0-react, auth0-vue, or auth0-angular for client-side auth
Next.js applications - Use auth0-nextjs skill which handles both client and server
Mobile applications - Use auth0-react-native for React Native/Expo
Stateless APIs - Use JWT validation middleware instead of session-based auth
Microservices - Use JWT validation for service-to-service auth

Quick Start Workflow

1. Install SDK

npm install express-openid-connect dotenv

2. Configure Environment

For automated setup with Auth0 CLI , see Setup Guide for complete scripts.

For manual setup:

Create .env:

SECRET=<openssl-rand-hex-32>
BASE_URL=http://localhost:3000
CLIENT_ID=your-client-id
CLIENT_SECRET=your-client-secret
ISSUER_BASE_URL=https://your-tenant.auth0.com

Generate secret: openssl rand -hex 32

3. Configure Auth Middleware

Update your Express app (app.js or index.js):

require('dotenv').config();
const express = require('express');
const { auth, requiresAuth } = require('express-openid-connect');

const app = express();

// Configure Auth0 middleware
app.use(auth({
  authRequired: false,  // Don't require auth for all routes
  auth0Logout: true,    // Enable logout endpoint
  secret: process.env.SECRET,
  baseURL: process.env.BASE_URL,
  clientID: process.env.CLIENT_ID,
  issuerBaseURL: process.env.ISSUER_BASE_URL,
  clientSecret: process.env.CLIENT_SECRET
}));

app.listen(3000, () => {
  console.log('Server running on http://localhost:3000');
});

This automatically creates:

/login - Login endpoint
/logout - Logout endpoint
/callback - OAuth callback

4. Add Routes

// Public route
app.get('/', (req, res) => {
  res.send(req.oidc.isAuthenticated() ? 'Logged in' : 'Logged out');
});

// Protected route
app.get('/profile', requiresAuth(), (req, res) => {
  res.send(`
    <h1>Profile</h1>
    <p>Name: ${req.oidc.user.name}</p>
    <p>Email: ${req.oidc.user.email}</p>
    <pre>${JSON.stringify(req.oidc.user, null, 2)}</pre>
    <a href="/logout">Logout</a>
  `);
});

// Login/logout links
app.get('/', (req, res) => {
  res.send(`
    ${req.oidc.isAuthenticated() ? `
      <p>Welcome, ${req.oidc.user.name}!</p>
      <a href="/profile">Profile</a>
      <a href="/logout">Logout</a>
    ` : `
      <a href="/login">Login</a>
    `}
  `);
});

5. Test Authentication

Start your server:

node app.js

Visit http://localhost:3000 and test the login flow.

Detailed Documentation

Setup Guide - Automated setup scripts, environment configuration, Auth0 CLI usage
Integration Guide - Protected routes, sessions, API integration, error handling
API Reference - Complete middleware API, configuration options, request properties

Common Mistakes

Mistake	Fix
Forgot to add callback URL in Auth0 Dashboard	Add `/callback` path to Allowed Callback URLs (e.g., `http://localhost:3000/callback`)
Missing or weak SECRET	Generate secure secret with `openssl rand -hex 32` and store in .env as `SECRET`
Setting authRequired: true globally	Set to false and use `requiresAuth()` middleware on specific routes
App created as SPA type in Auth0	Must be Regular Web Application type for server-side auth
Session secret exposed in code	Always use environment variables, never hardcode secrets
Wrong baseURL for production

Related Skills

auth0-quickstart - Basic Auth0 setup
auth0-migration - Migrate from another auth provider
auth0-mfa - Add Multi-Factor Authentication

Quick Reference

Middleware Options:

authRequired - Require auth for all routes (default: false)
auth0Logout - Enable /logout endpoint (default: false)
secret - Session secret (required)
baseURL - Application URL (required)
clientID - Auth0 client ID (required)
issuerBaseURL - Auth0 tenant URL (required)

Request Properties:

req.oidc.isAuthenticated() - Check if user is logged in
req.oidc.user - User profile object
req.oidc.accessToken - Access token for API calls
req.oidc.idToken - ID token
req.oidc.refreshToken - Refresh token

Common Use Cases:

Protected routes → Use requiresAuth() middleware (see Step 4)
Check auth status → req.oidc.isAuthenticated()
Get user info → req.oidc.user
Call APIs → Integration Guide

References

Weekly Installs

Repository

auth0/agent-skills

GitHub Stars

First Seen

Feb 6, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykWarn

Installed on

opencode72

codex71

github-copilot70

gemini-cli69

amp66

kimi-cli66

Auth0 Express 集成指南：为 Express.js 应用快速添加身份验证

🇨🇳中文介绍

Auth0 Express 集成

先决条件

何时不应使用

相关 Skills

快速开始工作流

1. 安装 SDK

2. 配置环境

3. 配置身份验证中间件

4. 添加路由

5. 测试身份验证

详细文档

常见错误

相关技能

快速参考

参考资料