wsfed

library8.0.0jsnpmunverified

WSFed server middleware (SAML) for Express.js to generate WS-Federation endpoints. Current stable version: 8.0.0 (released March 2026). Maintained by Auth0, with regular releases. Key differentiators: supports SAML assertions, JWT tokens, encryption, and metadata endpoint generation; designed to work with external user authentication. Alternatives include passport-saml or adal-node for WS-Federation.

auth-security web-framework communication

npm install wsfed

github ↗package ↗

INSTALL

IMPORT

SIG · WSFED

wsfed

auth-securityjavascriptv8.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import wsfed from 'wsfed'

✗ const wsfed = require('wsfed')

ESM-only since v8; require() will fail. Use dynamic import if needed.

wsfed.auth

✓ import { auth } from 'wsfed'

✗ const { auth } = require('wsfed')

Named export for auth middleware.

wsfed.metadata

✓ import { metadata } from 'wsfed'

✗ const { metadata } = require('wsfed')

Named export for metadata endpoint.

Sets up Express WSFed middleware for auth and metadata endpoints using PEM keys.

import express from 'express'; import wsfed from 'wsfed'; import fs from 'fs'; import path from 'path'; const app = express(); app.get('/wsfed', wsfed.auth({ issuer: 'the-issuer', cert: fs.readFileSync(path.join(__dirname, 'cert.pem')), key: fs.readFileSync(path.join(__dirname, 'key.pem')), getPostURL: function (wtrealm, wreply, req, callback) { // return the URL to post the result response to callback(null, 'http://someurl.com'); } })); app.get('/wsfed/FederationMetadata/2007-06/FederationMetadata.xml', wsfed.metadata({ issuer: 'the-issuer', cert: fs.readFileSync(path.join(__dirname, 'cert.pem')), })); app.listen(3000, () => console.log('WSFed server listening on port 3000'));

Debug

Known issues

breakingSince v8.0.0, encryption algorithm default changed to 'http://www.w3.org/2009/xmlenc11#aes256-gcm'. Old code relying on a different default may break.

fix

Explicitly set encryptionAlgorithm option to your desired algorithm if needed.

affects: >=8.0.0

breakingv8.0.0 introduced 'disallowEncryptionWithInsecureAlgorithm' defaulting to true. Assertions using insecure encryption algorithms will fail.

fix

Set disallowEncryptionWithInsecureAlgorithm: false if you must use insecure algorithms (not recommended).

affects: >=8.0.0

deprecatedjwtAllowInsecureKeySizes and jwtAllowInvalidAsymmetricKeyTypes options are insecure and deprecated. They exist only for backward compatibility.

fix

Avoid using these options; ensure proper key sizes and types.

affects: >=7.0.0

gotchaThe getPostURL callback expects (wtrealm, wreply, req, callback) -> callback(null, url). Returning a URL directly is incorrect.

fix

Always call the callback with two arguments: null and the URL string.

affects: *

gotchaThe cert and key options must be PEM strings, not file paths or buffers. Use fs.readFileSync to read the files into strings.

fix

Read file contents as UTF-8 or default to string via fs.readFileSync(path, 'utf8').

affects: *

Errors

Common errors & fixes

Cannot find module 'wsfed'

Package not installed or ESM import in CJS project.

fix

Install: npm install wsfed. If using CJS, use dynamic import: const wsfed = await import('wsfed');

TypeError: cb is not a function

The getPostURL callback is incorrectly defined; often due to using callbacks with async/await incorrectly.

fix

Ensure getPostURL function signature is (wtrealm, wreply, req, callback) and call callback(null, url).

Error: Failed to load certificate / key

Cert or key file path is incorrect or file is not in PEM format.

fix

Double-check file paths and use fs.readFileSync with 'utf8' encoding to get PEM string.

Upgrade

Version history

8.0.0latest on npm

Audit

Dependencies

expressoptionalmiddleware designed for Express.js

Agent activity

37 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/auth0/node-wsfed ↗

packagehttps://www.npmjs.com/package/wsfed ↗