Registry / auth-security / express-bearer-token

express-bearer-token

library3.0.0jsnpmunverified

express-bearer-token is an Express middleware for extracting RFC6750-compliant OAuth 2.0 bearer tokens from incoming HTTP requests. It attempts to locate a token in the 'Authorization: Bearer <token>' header, the 'access_token' field in the request body, or 'access_token' in query parameters. Optionally, it can also extract tokens from cookies. If found, the token is made available on `req.token`. Crucially, if multiple token sources are present, the middleware strictly adheres to RFC6750 by immediately aborting the request with an HTTP 400 status code. The package is currently at version 3.0.0 and ships with TypeScript types. Its release cadence appears to be slow, with the last major release two years ago, suggesting a mature, maintenance-focused project rather than active feature development.

auth-security web-framework

npm install express-bearer-token

github ↗package ↗

INSTALL

IMPORT

SIG · EXPRESS-BEARER-TOK

express-bearer-token

auth-securityjavascriptv3.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

bearerToken

✓ import bearerToken from 'express-bearer-token'

✗ import { bearerToken } from 'express-bearer-token'

The primary export is a default function for ESM. For CommonJS, use `const bearerToken = require('express-bearer-token');`

BearerTokenOptions

✓ import { type BearerTokenOptions } from 'express-bearer-token'

✗ import { BearerTokenOptions } from 'express-bearer-token'

Type import for configuring middleware options. Use the `type` keyword for clarity and bundle optimization in TypeScript.

Request (augmented)

✓ import 'express-bearer-token'

The package augments the Express `Request` interface, adding `req.token`. Simply installing the package and importing the middleware (even implicitly) typically makes this type available in TypeScript projects; sometimes an explicit import is needed in a global declaration file.

Demonstrates basic usage of the `express-bearer-token` middleware to extract a bearer token from various sources and make it available on `req.token` for subsequent route handlers.

import express from 'express'; import bearerToken from 'express-bearer-token'; const app = express(); app.use(bearerToken()); app.get('/', (req, res) => { if (req.token) { res.send('Token found: ' + req.token); } else { res.status(401).send('No token provided'); } }); app.listen(8000, () => { console.log('Server listening on port 8000.\nTest with: `curl -H "Authorization: Bearer mytoken" localhost:8000`'); console.log('Or: `curl -X POST -d "access_token=bodytoken" localhost:8000`'); });

Debug

Known issues

breakingThe `cookie` option configuration changed in v3.0.0. Specifically, the `key` property within the `cookie` object was removed, and the `name` property was renamed to `key`.

fix

If configuring cookie token extraction, update your `cookie` configuration to use `key` for the cookie's name, e.g., `{ cookie: { key: 'access_token', signed: true, secret: '...' } }`.

affects: >=3.0.0

breakingIn v2.0.0, the extracted token was stored on `req.bearerToken`. This was changed to `req.token` for brevity and consistency.

fix

Migrate all references from `req.bearerToken` to `req.token` in your application code.

affects: >=2.0.0 <3.0.0

gotchaBy default, `express-bearer-token` strictly adheres to RFC6750. If a bearer token is provided in more than one location (e.g., in the Authorization header and also in the request body), the request will be aborted with an HTTP 400 error.

fix

Ensure client applications send the bearer token in only one location per request (typically the `Authorization: Bearer` header).

affects: >=1.0.0

gotchaUsing unsigned cookies with the `cookie` option (i.e., `cookie.signed: false`) can make your application vulnerable to cookie spoofing, allowing attackers to modify tokens without detection.

fix

Always use signed cookies by setting `cookie.signed: true` and providing a strong `secret` to prevent token tampering. Example: `bearerToken({ cookie: { signed: true, secret: 'YOUR_APP_SECRET', key: 'access_token' } })`.

affects: >=1.0.0

Errors

Common errors & fixes

Error: secret must be provided when signed is true

The `cookie.signed` option was set to `true`, but the required `secret` option, used for signing and verifying cookies, was omitted from the configuration.

fix

Provide a secret string in the `cookie` configuration object: `bearerToken({ cookie: { signed: true, secret: 'your-super-secret-key' } })`.

Property 'token' does not exist on type 'Request'.

This TypeScript compiler error indicates that `req.token` is not recognized on the Express `Request` interface, often because the package's type augmentations are not being picked up correctly.

fix

Ensure `express-bearer-token` is installed and that your `tsconfig.json` properly includes `node_modules/@types` or `express-bearer-token` types in its `typeRoots` or `types` configuration. Sometimes, adding `import 'express-bearer-token';` in a global type definition file (e.g., `src/types.d.ts`) can help resolve type merging issues.

Upgrade

Version history

3.0.0latest on npm

Audit

Dependencies

expressrequiredRuntime dependency as a middleware for Express applications.

Agent activity

23 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/tkellen/node-express-bearer-token ↗

packagehttps://www.npmjs.com/package/express-bearer-token ↗