Node.js quickstart

import * as client from 'openid-client'
import { config } from './config.js'

export async function startLogin(req, res) {
  const code_verifier = client.randomPKCECodeVerifier()
  const code_challenge = await client.calculatePKCECodeChallenge(code_verifier)
  const state = client.randomState()

  // Store both values in the user session — the callback requires them
  req.session.code_verifier = code_verifier
  req.session.state = state

  const parameters = {
    redirect_uri: process.env.APP_REDIRECT_URI,
    scope: 'openid profile channel',
    code_challenge,
    code_challenge_method: 'S256',
    state,
  }

  res.redirect(client.buildAuthorizationUrl(config, parameters).href)
}

import * as client from 'openid-client'
import { config } from './config.js'

export async function handleCallback(req, res) {
  const currentUrl = new URL(req.url, process.env.APP_REDIRECT_URI)

  let tokens
  try {
    tokens = await client.authorizationCodeGrant(config, currentUrl, {
      pkceCodeVerifier: req.session.code_verifier,
      expectedState: req.session.state,
    })
  } catch (err) {
    // The user did not go through with the sign-in: the answer carries error=access_denied
    // instead of a code. That is an answer, not a fault.
    if (err instanceof client.AuthorizationResponseError && err.error === 'access_denied') {
      res.redirect('/signin-cancelled')
      return
    }
    throw err
  }

  const claims = tokens.claims()          // the parsed id_token
  req.session.user = {
    sub: claims.sub,
    name: claims.name,
    channel_type: claims.channel_type,    // only with the channel scope (step 7)
  }

  res.redirect('/')
}

import express from 'express'
import session from 'express-session'

import { startLogin } from './login.js'
import { handleCallback } from './callback.js'

const app = express()

// express-session is what puts req.session in place — the PKCE code_verifier and the
// state live there while the user is confirming on the phone. The default store keeps
// sessions in the memory of one process: enough for this walkthrough, not for production.
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
}))

app.get('/login', startLogin)
app.get('/callback', handleCallback)

app.get('/', (req, res) => {
  if (req.session.user === undefined) {
    res.redirect('/login')
    return
  }

  res.json(req.session.user)
})

// Where the callback sends a user who did not go through with the sign-in. A route of its own
// because "/" sends an anonymous visitor to /login — straight back to the page they just left.
app.get('/signin-cancelled', (req, res) => {
  res.send('Sign-in was cancelled. Open / to sign in again.')
})

app.listen(3000, '127.0.0.1')