The auth0-spa-js repository is a JavaScript/TypeScript SDK for authenticating Single Page Applications (SPAs) with Auth0. It implements the Authorization Code Flow with PKCE, providing methods for user login (redirect and popup), silent token acquisition, token refresh, logout, and user information retrieval. The SDK includes advanced features such as Multi-Factor Authentication (MFA), passkey/WebAuthn support, DPoP (Demonstrating Proof of Possession) for token security, Multi-Resource Refresh Tokens (MRRT), and custom token exchange per RFC 8693. Architecture-wise, it is modular with separate concerns: core authentication (Auth0Client), caching (memory and localStorage), storage (cookies and session storage), Web Worker for token operations, and specialized modules for MFA, passkeys, and account management. Key entry points include the `createAuth0Client` factory function and the `Auth0Client` class. The library relies on @auth0/auth0-auth-js for low-level Auth0 interactions and browser-tabs-lock for cross-tab synchronization.
remix-auth-oauth2 is a TypeScript library that provides an OAuth2 strategy for the Remix authentication framework (remix-auth). It implements the OAuth2 Authorization Code flow with PKCE, supporting standard endpoints, refresh tokens, token revocation, and OIDC discovery. The library is designed as a drop-in strategy for Remix apps, handling the redirect to the provider, state validation, token exchange, and invoking a user-supplied verify callback with the obtained tokens and request. It also exports error classes and the CodeChallengeMethod enum for convenience. The architecture is a single Strategy class extending remix-auth's Strategy base, backed by the arctic OAuth2 client library for protocol-level operations. The core logic lives in src/index.ts, with a small helper for redirects and a custom StateStore class that manages multiple concurrent OAuth flows by storing state and code verifiers in cookies. The StateStore is particularly well-crafted: it supports multiple simultaneous authorization attempts (e.g., multiple browser tabs) by merging cookie entries and using unique cookie names per flow, preventing race conditions. The codebase is clean, well-typed, and thoroughly tested with bun:test and MSW, covering redirect generation, state mismatch errors, token exchange, discovery, and concurrency. CI/CD is fully configured with GitHub Actions for build, typecheck, quality, tests, and npm publishing. The library is actively maintained, with recent commits, dependabot updates, and a low technical drift relative to its ecosystem.
angular-oauth2-oidc is an Angular client library for OAuth 2.0 and OpenID Connect authentication in browser SPAs. Its core is OAuthService, a large stateful injectable that loads OIDC discovery documents, drives login via implicit flow, code flow + PKCE, or password flow, stores tokens through a pluggable OAuthStorage (default sessionStorage, with MemoryStorage fallback), validates tokens through pluggable ValidationHandler implementations, runs silent refresh/session checks via hidden iframes, and emits a typed event stream (OAuthEvent hierarchy) for lifecycle notifications. DefaultOAuthInterceptor attaches bearer tokens to outgoing HTTP calls against configured allowed URLs; UrlHelperService extracts tokens from redirect URLs for both hash and query strategies.
OSIN is a Go library implementing an OAuth 2.0 authorization server as defined in RFC 6749, with support for PKCE (RFC 7636). It provides a modular server with configurable storage backends, token generators, and client authentication. The library handles all standard grant types: authorization code, implicit, resource owner password credentials, client credentials, refresh token, and assertion. It also includes non-standard info endpoints. The architecture is centered around a `Server` struct with pluggable `Storage` and token generator interfaces. Key entry points are `HandleAuthorizeRequest`, `HandleAccessRequest`, and `HandleInfoRequest`, which users integrate into their HTTP handlers. The code is well-structured and tested, but the project is in maintenance-only mode with outdated dependencies (e.g., jwt-go v3, jose.v1) and no recent commits. It remains a solid reference implementation for OAuth2 server logic in Go.
This is a fully-featured OAuth2 and OpenID Connect authentication and authorization server built with Node.js/TypeScript and the Curveball framework. It provides user management, role-based access control, multi-factor authentication (TOTP, WebAuthn), and an administrative web UI. The project is self-contained with its own database migrations, CLI binary, and Docker support. It supports multiple database backends (PostgreSQL, MySQL, SQLite) via Knex. The codebase is well-structured following a modular architecture with clear separation between controllers, services, and format handlers. It implements the OAuth2 authorization framework including authorization code, client credentials, implicit, and refresh token grants with PKCE support. The OpenID Connect layer provides discovery, JWKS, and userinfo endpoints. Authentication is modular with pluggable challenge strategies for passwords, TOTP, email OTP, and WebAuthn. The project is retired, as explicitly stated in the README, and the authors recommend migrating to Keycloak. Despite being deprecated, the code remains a solid reference implementation for OAuth2/OIDC in Node.js and contains several reusable components including an abstract key-value store, an SMS adapter pattern, and cryptographic utilities.