Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
createServer
✓ const oauth2orize = require('oauth2orize');
const server = oauth2orize.createServer();
✗ import { createServer } from 'oauth2orize';
OAuth2orize is a CommonJS module. ESM imports are not supported.
grant.code
✓ const oauth2orize = require('oauth2orize');
server.grant(oauth2orize.grant.code(...));
✗ import { grant } from 'oauth2orize';
server.grant(grant.code(...));
Grant types are exposed as properties of `oauth2orize.grant`.
exchange.code
✓ const oauth2orize = require('oauth2orize');
server.exchange(oauth2orize.exchange.code(...));
✗ import { exchange } from 'oauth2orize';
server.exchange(exchange.code(...));
Exchange types are exposed as properties of `oauth2orize.exchange`.
Demonstrates a basic OAuth 2.0 authorization server setup using `oauth2orize` with Express and Passport, including authorization code grant and exchange. It includes mocked storage for clients, users, authorization codes, and access tokens to be runnable.
const express = require('express');
const oauth2orize = require('oauth2orize');
const passport = require('passport');
const BasicStrategy = require('passport-http').BasicStrategy;
// Mock database/storage for demonstration
const db = {
clients: [{ id: 'client1', secret: 'secret1', redirectUri: 'http://localhost:3000/auth/example/callback' }],
users: [{ id: 'user1', username: 'testuser', password: 'password' }],
authorizationCodes: [],
accessTokens: []
};
// Mock utility for UID generation
const utils = {
uid: (len) => Math.random().toString(36).substring(2, 2 + len)
};
const app = express();
app.use(express.urlencoded({ extended: true })); // For parsing x-www-form-urlencoded
app.use(express.json()); // For parsing application/json
app.use(require('express-session')({ secret: 'keyboard cat', resave: false, saveUninitialized: false }));
app.use(passport.initialize());
app.use(passport.session());
// Passport setup (simplified for example)
passport.use(new BasicStrategy(function(username, password, done) {
const user = db.users.find(u => u.username === username && u.password === password);
if (!user) { return done(null, false); }
return done(null, user);
}));
passport.serializeUser(function(user, done) { done(null, user.id); });
passport.deserializeUser(function(id, done) {
const user = db.users.find(u => u.id === id);
done(null, user);
});
// Create OAuth 2.0 server
const server = oauth2orize.createServer();
// Register authorization code grant type
server.grant(oauth2orize.grant.code(function(client, redirectURI, user, ares, done) {
const code = utils.uid(16);
db.authorizationCodes.push({ code, clientId: client.id, redirectUri, userId: user.id, scope: ares.scope });
done(null, code);
}));
// Register authorization code exchange type
server.exchange(oauth2orize.exchange.code(function(client, code, redirectURI, done) {
const authCode = db.authorizationCodes.find(ac => ac.code === code && ac.clientId === client.id && ac.redirectUri === redirectURI);
if (!authCode) { return done(null, false); }
// Remove code after use (one-time use)
db.authorizationCodes = db.authorizationCodes.filter(ac => ac.code !== code);
const token = utils.uid(256);
db.accessTokens.push({ token, userId: authCode.userId, clientId: authCode.clientId, scope: authCode.scope });
done(null, token);
}));
// Authorization endpoint
app.get('/dialog/authorize',
passport.authenticate('session'), // Ensure user is logged in via Passport session
server.authorize(function(clientId, redirectURI, done) {
const client = db.clients.find(c => c.id === clientId);
if (!client) { return done(null, false); }
if (client.redirectUri !== redirectURI) { return done(new Error('Invalid redirect URI'), false); }
done(null, client, client.redirectUri);
}),
function(req, res) {
// Render a consent dialog
res.send(`
<h1>Authorize ${req.oauth2.client.id} to access your account?</h1>
<form action="/dialog/authorize/decision" method="POST">
<input type="hidden" name="transaction_id" value="${req.oauth2.transactionID}">
<input type="submit" value="Allow" name="allow">
<input type="submit" value="Deny" name="deny">
</form>
`);
}
);
// Decision endpoint
app.post('/dialog/authorize/decision',
passport.authenticate('session'),
server.decision()
);
// Token endpoint
app.post('/oauth/token',
passport.authenticate(['basic', 'oauth2-client-password'], { session: false }),
server.token(),
server.errorHandler()
);
app.listen(3000, () => console.log('OAuth2orize server listening on port 3000'));
Errors
Common errors & fixes
TypeError: oauth2orize.createServer is not a function
Attempting to use ES Module `import` syntax (`import { createServer } from 'oauth2orize'`) with a CommonJS-only library.
fixUse CommonJS `require` syntax: `const oauth2orize = require('oauth2orize'); const server = oauth2orize.createServer();` Error: Invalid redirect URI
The `redirectURI` provided by the client in the authorization request does not exactly match the `redirectUri` registered for that client on your OAuth2orize server.
fixEnsure the `redirectURI` in your client registration (`db.clients` in the example) precisely matches the `redirect_uri` parameter sent by the client in the authorization request.
ReferenceError: XXX is not defined (e.g., AuthorizationCode, AccessToken, utils)
The example code in the documentation often uses placeholder models or utility functions (`AuthorizationCode`, `AccessToken`, `utils.uid`) that are not part of `oauth2orize` itself and must be provided by the implementer.
fixDefine these models/utilities (e.g., `AuthorizationCode` and `AccessToken` classes with persistence logic, or a `utils` object with a `uid` function) in your application code.
Audit
Dependencies
passportrequiredStrongly coupled for user authentication; often used with connect-ensure-login for session management.
expressoptionalDesigned to be used as Express middleware for handling authorization endpoints.