Okta Node.js OIDC Middleware

const express = require('express');
const session = require('express-session');
const { ExpressOIDC } = require('@okta/oidc-middleware');

const app = express();

const oidc = new ExpressOIDC({
  issuer: process.env.OKTA_ISSUER || 'https://{yourOktaDomain}/oauth2/default',
  client_id: process.env.OKTA_CLIENT_ID || '{clientId}',
  client_secret: process.env.OKTA_CLIENT_SECRET || '{clientSecret}',
  appBaseUrl: process.env.OKTA_APP_BASE_URL || 'http://localhost:8080',
  scope: 'openid profile'
});

app.use(session({
  secret: process.env.SESSION_SECRET || 'a-very-long-random-string-that-you-should-change',
  resave: false,
  saveUninitialized: false
  // For production, replace MemoryStore with a persistent store (e.g., connect-redis)
}));
app.use(oidc.router);

app.get('/', (req, res) => {
  if (req.userContext) {
    res.send(`
      Hello ${req.userContext.userinfo.name}!
      <form method="POST" action="/logout">
        <button type="submit">Logout</button>
      </form>
    `);
  } else {
    res.send('Please <a href="/login">login</a>');
  }
});

app.get('/protected', oidc.ensureAuthenticated(), (req, res) => {
  res.send('This is a protected page. Welcome, ' + req.userContext.userinfo.name);
});

const port = process.env.PORT || 8080;
oidc.on('ready', () => {
  app.listen(port, () => console.log(`App has started on port ${port}`));
});
oidc.on('error', err => {
  console.error('OIDC error: ', err);
});