OpenID Connect — OIDC Authentication Patterns for Modern Applications

// OIDC client setup
const { Issuer } = require('openid-client');

async function setupOIDC() {
  const issuer = await Issuer.discover('https://auth.example.com');
  const client = new issuer.Client({
    client_id: 'oidc-client',
    client_secret: 'client-secret',
    redirect_uris: ['https://app.example.com/callback'],
    response_types: ['code'],
    token_endpoint_auth_method: 'client_secret_post'
  });

  return client;
}

// Authentication request with OIDC
app.get('/auth/login', async (req, res) => {
  const client = await setupOIDC();
  const authUrl = client.authorizationUrl({
    scope: 'openid profile email scan:read',
    state: crypto.randomUUID(),
    nonce: crypto.randomUUID()
  });

  req.session.oidc_state = authUrl.state;
  req.session.oidc_nonce = authUrl.nonce;
  res.redirect(authUrl);
});

// Callback handling
app.get('/callback', async (req, res) => {
  const client = await setupOIDC();
  const params = client.callbackParams(req);
  const tokenSet = await client.callback('https://app.example.com/callback', params, {
    state: req.session.oidc_state,
    nonce: req.session.oidc_nonce
  });

  const userInfo = await client.userinfo(tokenSet.access_token);
  // userInfo contains: sub, email, name, preferred_username, etc.

  req.session.user = userInfo;
  res.redirect('/dashboard');
});