@kevinhle/express-aad-jwt

This is an express middleware that validates AAD-issued (Azure Active Directory) JsonWebToken (JWT) and set the req.user with the decoded JWT.

Install

npm i @kevinhle/express-aad-jwt

Usage

If the JWT is included as bearer scheme in the Authorization attribute of the header request, the request will be augmented to include the decoded JWT. The way the request is augmented is that now the request will include the property user which contains the decoded JWT.

In the case JWT is invalid or expires or authorization header is missing in the request, if you want to stop the middleware chain and ultimately the route, set shouldThrow to true and include some error handler for gracefull failure.

const expressAadJwt = require('@kevinhle/express-aad-jwt')

app.use(
  expressAadJwt({
    tenant: 'your-tenant-name.onmicrosoft.com',
    shouldThrow: true,
  })
)

//error handler
app.use((err, req, res, next) => {
  if (err) {
    res.status(401).json({ Error: err.message })
  }
})

If you want the middleware chain to continue (where you might to check the request.user object) then pass false for shouldThrow or just omit it

apollo-server-express

@kevinhle/express-aad-jwt can be paired nicely with graphql-shield to provide authentication (and authorization) for apollo-server-express. Here's an example of how to do in typescript:

//server.ts
const { ApolloServer, gql } = require('apollo-server-express')
const { makeExecutableSchema } = require('@graphql-tools/schema')
const { ApolloServerPluginLandingPageDisabled } = require('apollo-server-core')
const express = require('express')
const { applyMiddleware } = require('graphql-middleware')
const expressAadJwt = require('@kevinhle/express-aad-jwt')
const permissions = require('./permissions/permissions')

const books = [
  {
    title: 'The Old Man and the Sea',
    author: 'Ernest Hemingway',
  },
  {
    title: 'Twenty Thousand Leagues Under the Seas',
    author: 'Jules Verne',
  },
]

const typeDefs = gql`
  type Book {
    title: String
    author: String
  }

  type Query {
    books: [Book]
  }
`

const resolvers = {
  Query: {
    books: () => books,
  },
}

async function startApolloServer(typeDefs: any, resolvers: any) {
  const server = new ApolloServer({
    schema: applyMiddleware(
      makeExecutableSchema({
        typeDefs,
        resolvers,
      }),
      permissions
    ),
    context: ({ req }: { req: any }) => {
      const user = req.user || null
      return { user }
    },
  })

  // Required logic for integrating with Express
  await server.start()
  const app = express()

  app.use((req: any, res: any, next: Function) => {
    console.log('Express middleware called')
    next()
  })

  app.use(
    '/gql',
    expressAadJwt({ tenant: 'some-tenant.onmicrosoft.com', shouldThrow: false })
  )

  app.use('/something', (req: any, res: any, next: Function) => {
    res.status(200).json({ status: 'ok' })
  })

  //error handler
  app.use((err: Error, req: any, res: any, next: Function) => {
    if (err) {
      res.status(401).json({ Error: err.message })
    }
  })

  server.applyMiddleware({
    app,
    path: '/gql',
  })

  await new Promise((resolve) => app.listen({ port: 4001 }, resolve))
  console.log(`🚀 Server ready at http://localhost:4001${server.graphqlPath}`)
}

startApolloServer(typeDefs, resolvers)

where permissions is defined in permissions.ts as follow:

//permissions.ts
const { shield, and, not } = require('graphql-shield')
const { rule } = require('graphql-shield')

const isAuthenticated = rule({ cache: 'contextual' })(
  async (parent: any, args: any, { user }: { user: any }) => {
    if (!user) {
      console.log('Not authenticated!!!')
    } else {
      console.log(user)
    }
    return !!user
  }
)

module.exports = shield({
  Query: {
    books: isAuthenticated,
  },
  /* Mutation: {
    updateBook: isAuthenticated,
  }, */
})

In the above example, you would want shouldThrow to be false so that your Apollo Studio Sandbox is accessible (at https://studio.apollographql.com/sandbox/explorer?endpoint=http%3A%2F%2Flocalhost%3A4001%2Fgql).

However, when the client sends a GraphQL request and does not include any AAD-issued or invalid JWT, then the request won't be augmented with the decoded JWT added to request.user object. As a result, graphql-shield will error out all query and mutation operations without valid AAD-issued JWT.