appsync-lambda-authorizers VS node-jsonwebtoken

The first version of this article was based on independently provision the needed AWS resources via CDK, on its own folder/project. Nevertheless in the AWS Community Builders Slack channel, I came to know that a related feature was being released by the AWS Amplify team which brought me to revisit the article with slightly different but cleaner implementation. This synthetizes the awesomeness of the program. You can find the before and after custom resources implementation in GitHub.

JsonWebToken

The code uses the jsonwebtoken library to generate and verify JSON Web Tokens. It provides two endpoints, /login and /profile.

Well, I found how an OpenID Connect id_token should be validated. It wasn't straightforward in my case: I had to do a lot of research to validate my id_token. Let's see how to make this easy using Node.js and the jsonwebtoken npm package made by Auth0.

tests/test/__tests__: Writing tests is an important practice in software development, and in NPM packages you'll often see them stored in one of these folders. It can also be used to hold testing helpers and utility functions. Example from express.

As we could see, we go through the same procedure for every provider. First, we obtain access_token and use it to receive the user's info. In Increaser, once the user is validated, the back-end generates auth data via jsonwebtoken library.

I'm currently looking for a way to sign and refresh my tokens. Most tutorials out there make use of jsonwebtoken another library that hasn't been updated in more than 2 years (except a commit to readme).

I'm trying to integrate microsoft sign in into my app. I've got a backend endpoint that handles the auth redirect and exchanges the auth code for an ID Token and an Access Token. I've heard that some OIDC implementations don't require validating an ID Token. Does my set up sound like it should be doing this? If so, how do I validate these tokens? I'm planning on using this library https://github.com/auth0/node-jsonwebtoken which allows you to do jwt.verify(token, 'secret') but I can't figure out what 'secret' to use. Is this my client secret? Or something else?

Some verify functions such as the popular Auth0 node-jsonwebtoken library requires the public key in PEM format. There are many libraries available to do this conversation.

Don't write your own decode or verify functions, use a library like https://github.com/auth0/node-jsonwebtoken.

JWT