azure-ad-jwt-lite

Lightweight library to verify AzureAD JSON Web Tokens.

It weights around 12KB alone and less than 320KB with its only one dependeny: jsonwebtoken

Other libraries generally includes request and are bloated. I decided to write this lib because the previous helper I used weighted more than 4MB with all its dependencies!

Futhermore, it is written in typescript and provide its own type definitions.

Last but not least, it is unit tested with one-hundred percent test coverage.

Need lightweight lib to verify AWS Cognito tokens ? Check this out

Getting started

Install the package using yarn or NPM: npm i azure-ad-jwt-lite

Do not forget to install jsonwebtoken types definitions as dev dependency if you are using Typescript: npm i -D @types/jsonwebtoken.

In your authentication middleware decode and verify the token using:

import { verifyAzureToken } from 'azure-ad-jwt-lite';

const decoded = await verifyAzureToken(token);

You can add any option supported by jsonwebtoken:

import { verifyAzureToken } from 'azure-ad-jwt-lite';

const decoded = await verifyAzureToken(token, {
  audience: process.env.JWT_AUD,
  issuer: process.env.JWT_ISS,
});

Additional options

• Discovery URL: The URL to fetch Microsoft public keys (defaults to https://login.microsoftonline.com/common/discovery/keys)

• Retries on 5xx: set the number of retries when request to fetch keys returns a 5xx response (defaults to 2)

import { verifyAzureToken } from 'azure-ad-jwt-lite';

const decoded = await verifyAzureToken(token, {
  discoveryUrl: `https://login.microsoftonline.com/${process.env.TENANT}/discovery/keys?appid=${process.env.APP_ID}`,
  maxRetries: 5,
  audience: process.env.JWT_AUD,
  issuer: process.env.JWT_ISS,
});

Caching keys

Public keys from discovery endpoint calls are cached for a default TTL of 5 minutes.

You can disable caching using useCache: false in options, or modify TTL using cacheTtl option.

Error reference

The lib will throw the following errors if something wrong happends during decoding token:

• InvalidToken: the token provided is not a non-empty string.
• TokenNotDecoded: the token cannot be decoded. This usually means the token is ill-formed.
• MissingKeyID: no kid (Microsoft Key ID) field is present in JWT header.
• ErrorFetchingKeys: API call to fetch Microsoft public keys failed.
• NotMatchingKey: no matching key is found in Microsoft response.
• JsonWebTokenError: token cannot be verified, the human-readable reason is provided (expired, audience mismatch etc...)