cognito-express-middleware

This package moved into cognito-toolkit v3 as the subpath export cognito-toolkit/express. Version 2.0.0 of this package is a frozen re-export thunk — it forwards everything from cognito-toolkit/express and will receive no further development. Depend on cognito-toolkit directly:

import {CognitoJwtVerifier} from 'cognito-toolkit';
import {makeAuth} from 'cognito-toolkit/express';

const verifier = CognitoJwtVerifier.create({userPoolId: 'us-east-1_MY_POOL', clientId: 'my-app-client', tokenUse: 'access'});
const auth = makeAuth({verifier});

app.use(auth.getUser); // req.user = decoded payload or null
app.get('/protected', auth.isAuthenticated, handler);

What changed in 2.0.0

• The implementation is now cognito-toolkit/express, built on AWS's official aws-jwt-verify — the 1.x homegrown verification stack is gone.
• getUser({region, userPoolId}) became makeAuth({verifier}) — you create the verifier via CognitoJwtVerifier.create(...) (note: clientId and tokenUse are now first-class checks).
• The former module statics (getUser.isAuthenticated, getUser.hasGroup, getUser.hasScope, getUser.isAllowed, getUser.stateUserProperty) are now members of the per-instance bundle returned by makeAuth — same names, same semantics.
• The auth-cookie features are preserved (authCookie, setAuthCookieOptions, user.setAuthCookie); the cookie domain now defaults to the request hostname (the 1.x req.host default breaks on Express 5, which keeps the port there).
• ESM-only (CommonJS consumers use require(esm) with named exports); Node 20+.

See the full migration guide and the cognito-toolkit documentation.

The last standalone release of this package is 1.4.9 (its documentation lives in this repo's git history and wiki).

License

The 3-Clause BSD License