Service Setup

To get started, let's create a new folder called service under the React application folder. cd into the folder and run:

yarn init -yyarn add express express-jwt jwks-rsa cors express-jwt-aserto dotenv

To the .env file we created previously, we'll add the following:

JWKS_URI=https://acmecorp.demo.aserto.com/dex/keysISSUER=https://acmecorp.demo.aserto.com/dexAUDIENCE=acmecorp-app

In the service folder, Create a file called api.js - that will be our server. To this file, we'll add the following dependencies:

require("dotenv").config();const express = require("express");const jwt = require("express-jwt");const jwksRsa = require("jwks-rsa");const cors = require("cors");const app = express();

In the next section we define the middleware function which will call our identity provider to verify the validity of the JWT (and also enable CORS): Express.js will pass the call to the checkJwt middleware which will determine whether the JWT sent to it is valid or not. If it is not valid, Express.js will return a 403 (Forbidden) response.

//Paste after the dependencies
const checkJwt = jwt({  // Dynamically provide a signing key based on the kid in the header and the signing keys provided by the JWKS endpoint  secret: jwksRsa.expressJwtSecret({    cache: true,    rateLimit: true,    jwksRequestsPerMinute: 5,    jwksUri: process.env.JWKS_URI,  }),
  // Validate the audience and the issuer  audience: process.env.AUDIENCE,  issuer: process.env.ISSUER,  algorithms: ["RS256"],});

Lastly, we set up a protected route which will use the checkJwt middleware:

// Enable CORSapp.use(cors());
// Protected API endpointapp.get("/api/protected", checkJwt, function (req, res) {  //send the response  res.json({    secretMessage: "Here you go, very sensitive information for ya!",  });});
// Launch the API Server at localhost:8080app.listen(8080);

Awesome! our service will be listening on port 8080 and we set up a protected endpoint. In the next section we'll test this endpoint by updating our application to send a JWT token.