playerony/validate-azure-ad-token

Function to validate access token received from azure active directory. Useful when you're using a msal library to authenticate users on the frontend and you wanna verify Microsoft tokens in the API.

Validate Azure AD Token

This is a function that can be used to validate an access token received from Azure Active Directory. It is particularly useful when you're using a MSAL library to authenticate users on the frontend and you want to verify Microsoft tokens in the API.

Documentation

For more information about the required props to validate your token and the library itself, please refer to the API Documentation

Installation

  yarn add validate-azure-ad-token
  npm install validate-azure-ad-token

Validation Steps

1. Verify if all required props are passed in.
2. Decode the token using the jsonwebtoken library.
3. Send a request to https://login.microsoftonline.com/{tenantId}/discovery/keys?appid={applicationId} to receive all public keys unique to your applicationId and tenantId. This action is cached after one successful attempt.
4. Verify all required access token claims: aud, tid,iss,scp, appid, exp.
5. If the comparison succeeds, the token is valid.

Example

const validate = require('validate-azure-ad-token').default;

try {
  const decodedToken = await validate('YOUR_MICROSOFT_ACCESS_TOKEN', {
    tenantId: 'YOUR_TENANT_ID',
    audience: 'YOUR_AUDIENCE_ID',
    applicationId: 'YOUR_APPLICATION_ID',
    scopes: 'YOUR_SCOPES', // for example ["User.Read"]
  });

  // DO WHATEVER YOU WANT WITH YOUR DECODED TOKEN
} catch (error) {
  // ALL ERRORS GONNA SHOW HERE AS A STRING VALUE
}

Usage

If you are using a @azure/msal-react or @azure/msal-browser on the frontend site and you want to verify your Microsoft access token on your node server.

License

This project is licensed under the MIT License - see the LICENSE file for details.

validate-azure-ad-token's Issues

Can you please bump the jsonwebtoken version to ^9

Update Axios version

can you please update the Axios version, synk is noticing a security issue with the current version.

DON'T USE - Version 2 does not validate the signature

This package is dangerous. Version 2 does not validate the signature of the token. One can easily craft a token manually that gets accepted by this library.

validate-token-with-graph-api fails because the audience id of our web api is not the audience id auf Graph API

validate-azure-ad-token/src/index.ts

Line 87 in ec7dac5

await validateTokenWithGraphApi(accessToken, decodedAccessToken.payload);

This line produces "Access token validation failure. Invalid audience."
For me, this is clear. The audience id in our jwt tokens is the application id of our custom web api.
Graph API declines jwt tokens that are not issued for Graph API.
Why at all validate against graph api?

validate-token-header - does it really validate?

Hi,

I was just looking at the code for validate-token-header.ts and I am confused by what it does. It seems all validate-token-header is doing is getting a public key corresponding to the tokenHeader.kid property. After that it does not really validate the token using the public key. Is that correct?

const isValidPublicKey = data.keys.some((_key) => _key.kid === tokenHeader.kid); if (!isValidPublicKey) { throw new Error('The public key retrieved from the token header is invalid'); }

Thanks,
Sanjoy