Skip to main content

The Authorization Server

The AuthorizationServer is a core component of the OAuth 2.0 framework, responsible for authenticating resource owners and issuing access tokens to clients. This class provides a flexible and customizable implementation of an authorization server.

Initialization​

To create an instance of the AuthorizationServer, use the following constructor:

const authorizationServer = new AuthorizationServer(
  clientRepository,
  accessTokenRepository,
  scopeRepository,
  "secret-key",
  configuration,
);

Parameters:

  • clientRepository: An instance of the client repository
  • accessTokenRepository: An instance of the access token repository
  • scopeRepository: An instance of the scope repository
  • "secret-key": A string used for signing tokens (ensure this is kept secure)
  • configuration: An optional object for additional server configuration

Enabling Grant Types​

By default, no grant types are enabled when creating an AuthorizationServer. Each grant type must be explicitly enabled using the enableGrantType method. This approach allows for fine-grained control over which OAuth 2.0 flows your server supports.

authorizationServer.enableGrantType("client_credentials");
authorizationServer.enableGrantType("refresh_token");
authorizationServer.enableGrantType({
  grant: "authorization_code",
  userRepository,
  authorizationCodeRepository,
});
// any other grant types you want to enable

Note that the Authorization Code grant requires additional repositories: userRepository and authorizationCodeRepository.

Example: Enabling Multiple Grant Types​

You can enable multiple grant types on the same server:

const authorizationServer = new AuthorizationServer(
  clientRepository,
  accessTokenRepository,
  scopeRepository,
  "secret-key",
  configuration,
);

authorizationServer.enableGrantType("client_credentials");
authorizationServer.enableGrantType("refresh_token");
authorizationServer.enableGrantType({
  grant: "authorization_code",
  userRepository,
  authorizationCodeRepository,
});

Best Practices​

  1. Security: Keep the secret-key confidential and use a strong, unique value in production.
  2. Grant Types: Only enable the grant types necessary for your application to minimize potential attack vectors.

Additional Considerations​

  • PKCE Support: If implementing the Authorization Code grant, consider adding support for Proof Key for Code Exchange (PKCE) to enhance security for public clients.
  • Scope Validation: Implement proper scope validation in your scopeRepository to ensure clients only receive access to permitted resources.
  • Token Management: Implement token revocation and introspection endpoints for better token lifecycle management.
  • Error Handling: Implement comprehensive error handling to provide clear and secure responses for various error scenarios.