@kozojs/auth

JWT authentication middleware for Kozo Framework.

Install

npm install @kozojs/auth

Quick Start

import { createKozo } from '@kozojs/core';
import { jwtAuth } from '@kozojs/auth';

const app = createKozo();

// Protect all /api routes
app.use(jwtAuth({ secret: process.env.JWT_SECRET }));

app.get('/api/me', {}, (c) => {
  return c.get('jwtPayload'); // typed JWT payload
});

await app.nativeListen(3000);

Options

jwtAuth({
  // JWT secret (HS256) or key function (RS256)
  secret: 'my-secret',

  // Path prefix to protect (default: '/api')
  prefix: '/api',

  // Custom token extractor (default: Authorization: Bearer <token>)
  getToken: (c) => c.req.header('X-API-Token'),

  // Allowed algorithms (default: ['HS256', 'HS384', 'HS512'])
  allowedAlgorithms: ['RS256'],
})

Asymmetric Keys (RS256)

import { createRemoteJWKSet } from 'jose';

app.use(jwtAuth({
  getKey: createRemoteJWKSet(new URL('https://auth.example.com/.well-known/jwks.json')),
  allowedAlgorithms: ['RS256'],
}));

Error Handling

Unauthenticated requests automatically receive:

{ "error": "Unauthorized", "status": 401 }

License

MIT