OAuth 2.0 та OpenID Connect

<issuer>/.well-known/openid-configuration

npm init -y
npm install jose

export OIDC_ISSUER="https://your-provider.example"
export OIDC_CLIENT_ID="your-client-id"
export OIDC_CLIENT_SECRET="your-client-secret"
export OIDC_REDIRECT_URI="http://localhost:3000/callback"

import http from "node:http";
import crypto from "node:crypto";
import { URL } from "node:url";
import { createRemoteJWKSet, jwtVerify } from "jose";

const port = 3000;

const issuer = process.env.OIDC_ISSUER;
const clientId = process.env.OIDC_CLIENT_ID;
const clientSecret = process.env.OIDC_CLIENT_SECRET;
const redirectUri =
  process.env.OIDC_REDIRECT_URI ?? "http://localhost:3000/callback";

if (!issuer || !clientId || !clientSecret) {
  throw new Error(
    "Потрібно встановити OIDC_ISSUER, OIDC_CLIENT_ID та OIDC_CLIENT_SECRET"
  );
}

const sessions = new Map();
const loginTransactions = new Map();

function randomValue(bytes = 32) {
  return crypto.randomBytes(bytes).toString("base64url");
}

function createCodeChallenge(codeVerifier) {
  return crypto
    .createHash("sha256")
    .update(codeVerifier)
    .digest("base64url");
}

function parseCookies(request) {
  const header = request.headers.cookie;
  if (!header) {
    return {};
  }

  return Object.fromEntries(
    header.split(";").map((part) => {
      const index = part.indexOf("=");
      const name = part.slice(0, index).trim();
      const value = part.slice(index + 1).trim();
      return [name, decodeURIComponent(value)];
    })
  );
}

function sendHtml(response, statusCode, html, headers = {}) {
  response.writeHead(statusCode, {
    "content-type": "text/html; charset=utf-8",
    ...headers,
  });
  response.end(html);
}

function redirect(response, location, headers = {}) {
  response.writeHead(302, {
    location,
    ...headers,
  });
  response.end();
}

async function loadProviderConfiguration() {
  const discoveryUrl = new URL(
    ".well-known/openid-configuration",
    issuer.endsWith("/") ? issuer : `${issuer}/`
  );

  const response = await fetch(discoveryUrl);

  if (!response.ok) {
    throw new Error(`Discovery-запит завершився з кодом ${response.status}`);
  }

  return response.json();
}

const provider = await loadProviderConfiguration();
const jwks = createRemoteJWKSet(new URL(provider.jwks_uri));

const server = http.createServer(async (request, response) => {
  try {
    const requestUrl = new URL(request.url, `http://${request.headers.host}`);

    if (request.method === "GET" && requestUrl.pathname === "/") {
      const cookies = parseCookies(request);
      const session = cookies.session
        ? sessions.get(cookies.session)
        : undefined;

      if (!session) {
        sendHtml(
          response,
          200,
          `
            <h1>Вхід</h1>
            <p><a href="/login">Увійти через зовнішнього провайдера</a></p>
          `
        );
        return;
      }

      sendHtml(
        response,
        200,
        `
          <h1>Профіль</h1>
          <pre>${escapeHtml(JSON.stringify(session.user, null, 2))}</pre>
          <p><a href="/logout">Вийти</a></p>
        `
      );
      return;
    }

    if (request.method === "GET" && requestUrl.pathname === "/login") {
      const state = randomValue();
      const nonce = randomValue();
      const codeVerifier = randomValue(48);
      const codeChallenge = createCodeChallenge(codeVerifier);

      loginTransactions.set(state, {
        nonce,
        codeVerifier,
        createdAt: Date.now(),
      });

      const authorizationUrl = new URL(provider.authorization_endpoint);

      authorizationUrl.search = new URLSearchParams({
        client_id: clientId,
        redirect_uri: redirectUri,
        response_type: "code",
        scope: "openid profile email",
        state,
        nonce,
        code_challenge: codeChallenge,
        code_challenge_method: "S256",
      });

      redirect(response, authorizationUrl);
      return;
    }

    if (request.method === "GET" && requestUrl.pathname === "/callback") {
      const error = requestUrl.searchParams.get("error");

      if (error) {
        sendHtml(
          response,
          400,
          `<h1>Авторизацію відхилено</h1><p>${escapeHtml(error)}</p>`
        );
        return;
      }

      const code = requestUrl.searchParams.get("code");
      const state = requestUrl.searchParams.get("state");

      if (!code || !state) {
        sendHtml(response, 400, "<h1>Відсутні code або state</h1>");
        return;
      }

      const transaction = loginTransactions.get(state);
      loginTransactions.delete(state);

      if (!transaction) {
        sendHtml(response, 400, "<h1>Недійсний або прострочений state</h1>");
        return;
      }

      // Обмежуємо час життя транзакції входу.
      if (Date.now() - transaction.createdAt > 5 * 60 * 1000) {
        sendHtml(response, 400, "<h1>Транзакція входу прострочена</h1>");
        return;
      }

      const tokenResponse = await fetch(provider.token_endpoint, {
        method: "POST",
        headers: {
          "content-type": "application/x-www-form-urlencoded",
        },
        body: new URLSearchParams({
          grant_type: "authorization_code",
          client_id: clientId,
          client_secret: clientSecret,
          code,
          redirect_uri: redirectUri,
          code_verifier: transaction.codeVerifier,
        }),
      });

      if (!tokenResponse.ok) {
        const details = await tokenResponse.text();
        throw new Error(`Помилка token endpoint: ${details}`);
      }

      const tokens = await tokenResponse.json();

      if (!tokens.id_token) {
        throw new Error("Провайдер не повернув id_token");
      }

      const { payload } = await jwtVerify(tokens.id_token, jwks, {
        issuer,
        audience: clientId,
      });

      if (payload.nonce !== transaction.nonce) {
        throw new Error("Nonce у ID token не збігається");
      }

      if (typeof payload.sub !== "string") {
        throw new Error("ID token не містить коректного sub");
      }

      let user = {
        subject: payload.sub,
        issuer: payload.iss,
        name: payload.name,
        email: payload.email,
      };

      // UserInfo запит потрібен лише тоді, коли застосунку потрібні
      // додаткові дані профілю.
      if (tokens.access_token && provider.userinfo_endpoint) {
        const userInfoResponse = await fetch(provider.userinfo_endpoint, {
          headers: {
            authorization: `Bearer ${tokens.access_token}`,
          },
        });

        if (userInfoResponse.ok) {
          const userInfo = await userInfoResponse.json();

          if (userInfo.sub !== payload.sub) {
            throw new Error("sub у UserInfo не збігається з sub у ID token");
          }

          user = {
            ...user,
            name: userInfo.name ?? user.name,
            email: userInfo.email ?? user.email,
          };
        }
      }

      const sessionId = randomValue();
      sessions.set(sessionId, {
        user,
        createdAt: Date.now(),
      });

      redirect(response, "/", {
        "set-cookie": [
          `session=${encodeURIComponent(sessionId)}; HttpOnly; Path=/; SameSite=Lax`,
        ],
      });
      return;
    }

    if (request.method === "GET" && requestUrl.pathname === "/logout") {
      const cookies = parseCookies(request);

      if (cookies.session) {
        sessions.delete(cookies.session);
      }

      redirect(response, "/", {
        "set-cookie": [
          "session=; HttpOnly; Path=/; Max-Age=0; SameSite=Lax",
        ],
      });
      return;
    }

    sendHtml(response, 404, "<h1>Сторінку не знайдено</h1>");
  } catch (error) {
    console.error(error);
    sendHtml(response, 500, "<h1>Внутрішня помилка сервера</h1>");
  }
});

function escapeHtml(value) {
  return String(value)
    .replaceAll("&", "&amp;")
    .replaceAll("<", "&lt;")
    .replaceAll(">", "&gt;")
    .replaceAll('"', "&quot;")
    .replaceAll("'", "&#039;");
}

server.listen(port, () => {
  console.log(`Сервер запущено: http://localhost:${port}`);
});

iss + sub

provider_issuer
provider_subject
email
display_name

GET /userinfo
Authorization: Bearer ACCESS_TOKEN

http://localhost:3000/callback
http://localhost:3000/callback/

openid profile email