platform-auth

Cloudflare Access JWT validation.

Install

npm install platform-auth

Usage

import {
  createJwksCache,
  parseAccessJwtFromHeaders,
  verifyAccessJwt,
} from "platform-auth";

const jwks = createJwksCache(process.env.CF_ACCESS_JWKS_URL!);

const token = parseAccessJwtFromHeaders(request.headers);
if (token === null) return new Response("Unauthorized", { status: 401 });

const user = await verifyAccessJwt(token, {
  teamDomain: process.env.CF_ACCESS_TEAM_DOMAIN!,
  audience: process.env.CF_ACCESS_AUD!,
  jwks,
});

Gateway-fronted apps (confined origins)

If your app is fronted by the platform Entra-OIDC gateway and its pages.dev origin is confined (confine_origin=true), the apex bouncer strips Cf-Access-Jwt-Assertion. Read the gateway's un-clobbered X-Launchpad-User-Assertion instead, and verify against the gateway's issuer / audience / JWKS:

import { parseGatewayAssertionFromHeaders, verifyAccessJwt } from "platform-auth";

const token = parseGatewayAssertionFromHeaders(request.headers);
if (token === null) return new Response("Unauthorized", { status: 401 });

const user = await verifyAccessJwt(token, {
  teamDomain: process.env.GATEWAY_ISSUER!,
  audience: process.env.GATEWAY_AUD!,
  jwks: createJwksCache(process.env.GATEWAY_JWKS_URL!),
});

With the Hono middleware, pass header: "gateway" (default is "cf-access"):

createPlatformAuthMiddleware({
  header: "gateway",
  teamDomain: env.GATEWAY_ISSUER,
  audience: env.GATEWAY_AUD,
  jwks: createJwksCache(env.GATEWAY_JWKS_URL),
});

Each call reads exactly one explicitly-chosen header — there is no dual-read fallback.

License

MIT