express-openid-connect

express-openid-connect is Auth0’s official Express.js middleware for adding OpenID Connect authentication to server-rendered web applications. Mounting the auth() middleware wires up login, logout, and callback routes, validates ID tokens, and maintains an encrypted session cookie, so protecting routes becomes a matter of a few lines of configuration.

It works with any standards-compliant OpenID Connect provider (including Auth0), exposes request helpers like req.oidc for the current user and access tokens, and offers route guards such as requiresAuth and attemptSilentLogin. Sessions, cookies, and token handling are configurable, making it a batteries-included way to secure Express apps.

What You Get

• A single auth() middleware that mounts login, logout, and callback routes
• Encrypted, stateless session cookies with configurable storage and rolling sessions
• req.oidc request helpers for the current user, ID token, and access token
• Route guards: requiresAuth for protection and attemptSilentLogin for optional auth
• Works with any compliant OpenID Connect provider, not just Auth0

Common Use Cases

• Adding user login to a server-rendered Express web application
• Protecting specific routes behind authentication
• Managing user sessions without a separate session store
• Integrating any OpenID Connect identity provider into Express

Under The Hood

Architecture — lib/ holds the core: config.js validates options with joi, client.js wraps openid-client to talk to the provider, appSession.js and cookies.js implement the encrypted stateless session, and context.js builds the req.oidc request context. The middleware/ directory exposes auth.js (the main entry that registers routes), requiresAuth.js, attemptSilentLogin.js, and unauthorizedHandler.js as composable Express handlers.

Tech Stack — Node.js/JavaScript built on openid-client and jose for the OIDC flow and token/JWT handling, joi for config validation, plus cookie, http-errors, and debug utilities. It targets standard Express.

Code Quality — The repo carries Codecov coverage, CircleCI builds, and extensive EXAMPLES/FAQ docs. Concerns are cleanly separated between session, client, config, and routing modules, and options are strictly validated at startup.

API Design — The headline API is a single auth() call with a config object; sensible defaults mean minimal setup, while route guards and req.oidc helpers keep per-route usage terse. Escape hatches (hooks, custom session storage) exist without complicating the common path.