Express JS Auth0 – Ian ROCKS

After searching forever on how to integrate authorization into my backend using Auth0. Finding that multiple sources quote different ways of doing this. I thought I’d share what works for me here.

/middleware/auth.js

// In auth.js
import { expressjwt as jwt } from 'express-jwt';
import jwtAuthz from 'express-jwt-authz';
import jwksRsa from 'jwks-rsa';

const AUTH0_DOMAIN = process.env.AUTH0_DOMAIN;
const AUTH0_AUDIENCE = process.env.AUTH0_AUDIENCE;

const checkJwt = jwt({
    secret: jwksRsa.expressJwtSecret({
      cache: true,
      rateLimit: true,
      jwksRequestsPerMinute: 5,
      jwksUri: AUTH0_DOMAIN +'.well-known/jwks.json',
    }),
    audience: AUTH0_AUDIENCE,
    issuer: AUTH0_DOMAIN,
    algorithms: ['RS256'],
  });

  const checkScopes = (requiredScopes) => {
    return (req, res, next) => {
      jwtAuthz(requiredScopes, {
        failWithError: true,
        checkAllScopes: false,
      })(req, res, next);
    };
  };

  const checkPermissions = (requiredPermissions) => {
    return (req, res, next) => {

      const tokenPermissions = req.auth ? req.auth.permissions : [];
  
      const hasRequiredPermissions = requiredPermissions.every(permission => tokenPermissions.includes(permission));
  
      if (!hasRequiredPermissions) return res.status(403).json({ message: 'Insufficient permissions' });
  
      next();
    };
  };

export { checkJwt, checkScopes, checkPermissions };

Now when you want to add authorization to your routes, all you need to do is this:

import { checkJwt, checkPermissions } from '../middleware/auth.js';
import { getManagementApiToken, getUserMetadata } from '../utils/auth0/index.js';

const router = express.Router();


router.post('/create-user', checkJwt, checkPermissions(['create:users']), async (req, res) => {
    const token = await getManagementApiToken();
    const userData = {
        …req.body,
        connection: "Username-Password-Authentication" // Hardcoded connection name
    };

    try {
        const response = await axios.post(`https://${process.env.AUTH0_DOMAIN}/api/v2/users`, userData, {
            headers: { Authorization: `Bearer ${token}` }
        });
        res.json(response.data);
    } catch (error) {
        res.status(500).json({ message: 'Error creating user', error: error.response.data });
    }
});

Hopefully this helps someone save the time. Its simple with these functions.