@crossid/crossid-spa-js

OAuth2 and OIDC SDK for a single page application (SPA), using the authorization code flow with PKCE extension.

Get Started

Install by:

npm:

npm install @crossid/crossid-spa-js

yarn:

yarn add @crossid/crossid-spa-js

Init a client:

import { newCrossidClient, Client } from '@crossid/crossid-spa-js'
const crossid = newCrossidClient({
  domain: 'acme.us.crossid.io',
  client_id: 'my-client-id',
  authorizationOpts: {
    audience: ['example.com'],
    domain: 'acme.us.crossid.io'
    scope: 'openid profile',
    redirect_uri: 'http://localhost:3009',
  }
  // use session_storage or local_storage for a persistent cache.
  cache_type: 'memory',
})

note: the example above shows how to connect to a crossid tenant but this library can work with any OIDC authorization server that supports the PKCE extension. See newCrossidClientByDiscovery and newCrossidClientCustom.

To sign user in, call crossid.loginWithRedirect({}) to redirect browser to the authprization server login page. This function is typically bound to a button.

Once signing the user in completes successfully, the user will be redirected to the location specified in redirect_uri.

At this point, the signing in process must be completed by running the crossid.handleLoginRedirectCallback() function which will take care of completing the flow and caching the tokens.

To get an access token, which can be used to access your API:

const token = await client.getAccessToken()

To get the authenticated user:

const user = await client.getUser()

For a working example, see example repo.

Documentation

• Example Repo
• API Reference

Bugs and feature requests

Have a bug, feature request or feedback? Please first search for existing and closed issues. If your problem or idea is not addressed yet, please open a new issue.

Contributing

The main purpose of this repository is to continue evolving crossid-spa-js, making it more secure and easier to use. Development of this library happens in the open on GitHub, and we are grateful to the community for contributing bugfixes and improvements. Read below to learn how you can take part in improving crossid-spa-js.

Reporting a Vulnerability

The Crossid team takes security issues very seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.

To report a security issue, email [email protected].

We'll endeavor to respond quickly, and will keep you updated throughout the process.

What is Crossid?

Crossid can:

• Sign users in using various passwordless authentication factors (e.g., otp, fingerprint, etc...)
• Sign users in via social providers (e,g. Facebook) or enterprise providers (e.g., Azure)
• Multi factor authentication.
• Issue signed OAuth2 and Openid-Connect access tokens to protect API calls.
• Manage user profiles and access.

License

This project is licensed under the MIT license.