amplify-js
microsoft-authentication-library-for-js
Our great sponsors
amplify-js | microsoft-authentication-library-for-js | |
---|---|---|
42 | 27 | |
9,363 | 3,450 | |
0.1% | 2.4% | |
9.9 | 9.6 | |
7 days ago | 5 days ago | |
TypeScript | TypeScript | |
Apache License 2.0 | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
amplify-js
-
In Defense of Cognito
One note of caution, though: Amplify uses a frontend-only Cognito integration that stores long-lived, never-rotating refresh tokens in browser storage, where any XSS vulnerability would have access to them. A more secure approach is to implement a couple of backend API routes to store the refresh tokens in `HttpOnly` cookies instead, which I outlined here (option 1 in your case to support SSO). I'll probably open source a solution to do this early next year so we don't all have to keep reinventing this wheel (probably why AWS calls their conference re:invent).
-
Auth0 increases price by 300%
I'm ramosbugs on GitHub (that comment is mine). If you subscribe to https://github.com/aws-amplify/amplify-js/issues/1218 I'll post a comment there once I release a solution.
-
Server-Side Rendering with AWS Amplify
Amplify also lets you host a backend, which it runs in Lambda functions. You don't have a lot of control over it, but it works well for its intended audience: People who wouldn't know what to do if they had a lot of control over their Lambda functions. Amplify also lets you consume other AWS services easily, through declarative and easy-to-use libraries. That way, you can consume Cognito or S3 from the frontend without knowing a lot about Cognito or S3. Here's the complete list of libraries for Amplify, and you can check the Readme of the JavaScript one as an example of its features.
-
React Native Storage.put() results in error
Whenever I call Storage.put() inside my React Native (with Expo) application, I get an error of [TypeError: undefined is not a function]. Doing some internet digging, after hours of searching, I found only one other reference to this kind of error, and that is with the DataStore: https://github.com/aws-amplify/amplify-js/issues/10764
- How was you experience with nextJS using SSR in amplify?
-
SRP_A error when trying Custom Auth Passwordless flow
Hello! Can you please create a GitHub issue here for us to investigate this further? https://github.com/aws-amplify/amplify-js/issues
-
Cookies vs local storage - what to use when?
Thanks for bringing this up. This discussion on the project's github is equally insightful on the subject.
-
Understanding ID Token vs. Access Token in AWS Amplify
Amplify GitHub Issue
-
The Amplify Series, Part 6: Using the power of AI and Machine Learning with Amplify Predictions
Bug: There is currently, at the time of writing, a bug in Amplify that does not allow us to use the voiceId “Kevin”, which we selected when creating the backend resources. Selecting the voiceId “Amy” works, so we will use that.
- RFC: Amplify JS TypeScript Improvements
microsoft-authentication-library-for-js
-
Sveltekit Microsoft authentication
You can use the sample provided at https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-node-samples and integrate it in hooks.server.ts.
-
Token request cannot be made without authorization code or refresh token when I add "teamsAppInstallation.ReadWriteSelfForChat.All" scope
I'm utilizing the Authorization Code sample provided in the MSAL Node.js library (https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-node-samples/auth-code), with the only modification being the addition of the aforementioned scope to my configuration. Below, I've shared the relevant segment of my customConfig.json and the primary code snippet where the error surfaces.
- Does Azure AD B2C only employ OAuth2 / OIDC? Does it support any other mechanisms?
-
No Token in the Browser Pattern using Azure API Management
As the backend handles the token acquisition, no other code or library, such as MSAL.js, is required in the single-page application itself. This also means that no tokens are required to be stored in the browser session or local storage. By encrypting and storing the access token in an HttpOnly cookie protects it from XSS attacks, and scoping it to the API domain and setting SameSite=strict ensures that the cookie is automatically sent with all proxied API first-party requests. More on SameSite cookies can be read here.
- Web app with SSO and MS Graph access?
-
Redirect to a custom login page when securing your Angular app with MSAL
The easiest way to secure Angular apps with the Microsoft Identity Platform is by using the MSAL (Microsoft Authentication Library) Angular package. This package contains Angular-specific building blocks for implementing MSAL in your app.
-
New to Azure, can Azure logic apps help me keep an API access token fresh throughout the day? The API access token only lasts for one hour before it has to be refreshed via a refresh token.
For example: https://github.com/AzureAD/microsoft-authentication-library-for-js
-
A noob question on security/authentication (Azure AD related)
I was imagining something like this, and since you’ve got it on the frontend already just throwing the token to the backend and letting it validate the token https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/node-token-validation-samples/basic-sample
- [AskJS] Question about caching JWT in SPA
-
Laravel Azure Authentication with SPA
I did an azure ad implementation recently(laravel / SPA). I used the offical msal.js library (https://github.com/AzureAD/microsoft-authentication-library-for-js) to present the azure ad login screen. After successful login, I take the received azure ad access token and send it to my laravel based api. there, I verify the token and if valid and the user exists in the app, I create an access token for my apis and return it to the spa. The spa then uses this token for further requests, until the lifetime of the token expires. Hope that helps a bit, feel free to ask for details :)
What are some alternatives?
passwordless-auth - Allows a user to login directly via email without a need for entering passwords using Cognito
Cypress - Fast, easy and reliable testing for anything that runs in a browser.
Rollup - Next-generation ES module bundler
laravel-azure-ad-oauth - Drop-in socialiate plugin for Laravel applications for Microsoft Azure SSO.
apollo-server - 🌍 Spec-compliant and production ready JavaScript GraphQL server that lets you develop in a schema-first way. Built for Express, Connect, Hapi, Koa, and more.
Keycloak - Open Source Identity and Access Management For Modern Applications and Services
graphql-yoga - 🧘 Rewrite of a fully-featured GraphQL Server with focus on easy setup, performance & great developer experience. The core of Yoga implements WHATWG Fetch API and can run/deploy on any JS environment.
IdentityServer - The most flexible and standards-compliant OpenID Connect and OAuth 2.x framework for ASP.NET Core
AWS - AWS SDK for iOS. For more information, see our web site:
openiddict-core - Flexible and versatile OAuth 2.0/OpenID Connect stack for .NET
vite - Next generation frontend tooling. It's fast!
auth0-java - Java client library for the Auth0 platform