Integrate cidaas-interceptor : NodeJS (with express js)

The steps here will guide you to integrate the cidaas-interceptor into the NodeJS (Express.js) application.

npm install cidaas-interceptor-nodejs --save

check your package.json to verify the changes. in the dependency section


Cidaas Interceptor works as middleware,

Express js

var express = require('express');
var app = express();
var bodyParser = require("body-parser");
        extended: true

import { CidaasInterceptor, CidaasInterceptorConfig } from "cidaas-interceptor-nodejs";

// import and configure cidaas intcerceptor
let cidaas_interceptor = new CidaasInterceptor();

let interceptorConfig = new CidaasInterceptorConfig();

// add your cidaas base url to dicover the urls for you. it will internally discover the url from <cidaas-base-url>/.well-known/openid-configuration
interceptorConfig.baseUrl = “https://<cidaas-base-url>";

 // use_local_validation : enables the token validation done in offiline , which will improve the performance, LocalTokenCache.removeToken(access_token) need to be called manully when the on the logout webhook
interceptorConfig.use_local_validation = true; 
cidaas_interceptor.cidaasInterceptorConfig = interceptorConfig;

Check Scope

app.get("/serviceurl", cidaas_interceptor.expressMiddleware({ scopes: ["cidaas:write"] }), function (req, res) {

// your code


Check Role"/serviceurl", cidaas_interceptor.expressMiddleware({ roles: ["Admin"] }), function (req, res) {

// your code


Check Role and Scope

app.get("/serviceurl", cidaas_interceptor.expressMiddleware({ scopes: ["cidaas:write"], roles: ["Admin"] }), function (req, res) {

// your code



app.get("/serviceurl", cidaas_interceptor.expressMiddleware({denyAll : true}), function (req, res) {

// your code



 app.get("/serviceurl", cidaas_interceptor.expressMiddleware({permitAll : true}), function (req, res) {

// your code

OR just ignore the inceptor code

app.get("/serviceurl", function (req, res) {

// your code


Context variables (Magic variables)

Once the validation passed , cidaas will automatically add the __userid and __access_token in the Current header.


It contains the userid of the access_token and the passed access_token

Node vs Java interceptor comparison

1. Unlike Java interceptor , we have to add cidaas middleware in all of our required route methods. if method not don't have a cidaas interceptor middleware , that is equal to java's @PermitAll

2. Java's @OAuthScopes(scopes = { "cidaas:write", ... }) == global.cidaas_interceptor({ scopes: ["cidaas:write", ...]})

3. Java's @RolesAllowed(value = { "role1", "role2", ... }) == global.cidaas_interceptor({ roles: ["role1", "role2", ...]})

4. Don't have support for JWE.

results matching ""

    No results matching ""