use `express()` instead of `express.Router()` by phonzammi · Pull Request #604 · auth0/express-openid-connect

phonzammi · 2024-03-14T20:48:37Z

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

When we want to integrate/use this library with other frameworks (e.g. unjs/h3), we need to create an express app first than we can use this library. In this case we have to install express package too.
For example when using with unjs/h3

import {
  createApp,
  fromNodeMiddleware,
} from "h3";
import express from "express";

const app = createApp();
const expressApp = express();

app.use(fromNodeMiddleware(expressApp.use(auth(config))));

If we use it like this (without an express app) :

app.use(fromNodeMiddleware((auth(config)))

Than it will throws this errors

/home/phonzammi/Documents/vike-dev/practices/auth0/vike-h3-auth0/node_modules/.pnpm/express@4.18.3/node_modules/express/lib/router/layer.js:95
    fn(req, res, next);
    ^
TypeError: req.get is not a function
    at /home/phonzammi/Documents/vike-dev/practices/auth0/vike-h3-auth0/node_modules/.pnpm/express-openid-connect@2.17.1_express@4.18.3/node_modules/express-openid-connect/lib/appSession.js:289:37
    at Layer.handle [as handle_request] (/home/phonzammi/Documents/vike-dev/practices/auth0/vike-h3-auth0/node_modules/.pnpm/express@4.18.3/node_modules/express/lib/router/layer.js:95:5)
    at trim_prefix (/home/phonzammi/Documents/vike-dev/practices/auth0/vike-h3-auth0/node_modules/.pnpm/express@4.18.3/node_modules/express/lib/router/index.js:328:13)
    at /home/phonzammi/Documents/vike-dev/practices/auth0/vike-h3-auth0/node_modules/.pnpm/express@4.18.3/node_modules/express/lib/router/index.js:286:9
    at Function.process_params (/home/phonzammi/Documents/vike-dev/practices/auth0/vike-h3-auth0/node_modules/.pnpm/express@4.18.3/node_modules/express/lib/router/index.js:346:12)
    at next (/home/phonzammi/Documents/vike-dev/practices/auth0/vike-h3-auth0/node_modules/.pnpm/express@4.18.3/node_modules/express/lib/router/index.js:280:10)
    at Function.handle (/home/phonzammi/Documents/vike-dev/practices/auth0/vike-h3-auth0/node_modules/.pnpm/express@4.18.3/node_modules/express/lib/router/index.js:175:3)
    at router (/home/phonzammi/Documents/vike-dev/practices/auth0/vike-h3-auth0/node_modules/.pnpm/express@4.18.3/node_modules/express/lib/router/index.js:47:12)
    at file:///home/phonzammi/Documents/vike-dev/practices/auth0/vike-h3-auth0/node_modules/.pnpm/h3@1.11.1/node_modules/h3/dist/index.mjs:2285:24
    at new Promise (<anonymous>)

With this changes, we can use this library with other frameworks without having to create an express app

Testing

I have successfully tested this changes with fastify and unjs/h3

This change adds test coverage for new/changed/fixed functionality

Checklist

I have added documentation for new/changed functionality in this PR or in auth0.com/docs
All active GitHub checks for tests, formatting, and security are passing
The correct base branch is being used, if not the default branch

phonzammi · 2024-04-25T03:55:35Z

Hi @frederikprijck, I'm sorry to tag you.

Would you mind reviewing this PR ?
I'd like to know what do you think of this. is this a "breaking changes"?
Does Auth0 team has any plan to support more node js framework or more server environment?

Copilot

Pull Request Overview

This PR changes the authentication middleware from using express.Router() to express() to improve compatibility with other web frameworks like unjs/h3 and Fastify. The change allows the library to be used without requiring users to create a separate Express app instance.

Key changes:

Replace express.Router() with express() in the auth middleware
Update test assertions to access routes through ._router.stack instead of .stack

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
middleware/auth.js	Changes router instantiation from `express.Router()` to `express()`
test/login.tests.js	Updates test assertions to access router stack through `._router.stack` property

Copilot · 2025-07-18T06:27:50Z

middleware/auth.js

  const config = getConfig(params);
  debug('configuration object processed, resulting configuration: %O', config);
-  const router = new express.Router();
+  const router = new express();


Using express() instead of express.Router() creates a full Express application instance rather than just a router. This is a significant architectural change that may have unintended consequences. An Express app has additional overhead and functionality (like settings, engines, etc.) that may not be needed. Consider if this change could cause conflicts when the returned object is used as middleware in another Express app.

Suggested change

const router = new express();

const router = express.Router();

Copilot · 2025-07-18T06:27:50Z

test/login.tests.js

+    assert.ok(router._router.stack.some(filterRoute('GET', '/login')));
+    assert.ok(router._router.stack.some(filterRoute('GET', '/logout')));
+    assert.ok(router._router.stack.some(filterRoute('POST', '/callback')));
+    assert.ok(router._router.stack.some(filterRoute('GET', '/callback')));


Accessing the private _router property indicates a potential code smell. This implementation detail of Express may change in future versions, making the code brittle. The need to access _router.stack suggests that using express() instead of express.Router() may not be the optimal solution for the stated goal.

Suggested change

assert.ok(router._router.stack.some(filterRoute('GET', '/login')));

assert.ok(router._router.stack.some(filterRoute('GET', '/logout')));

assert.ok(router._router.stack.some(filterRoute('POST', '/callback')));

assert.ok(router._router.stack.some(filterRoute('GET', '/callback')));

const routes = getRoutes(router);

assert.ok(routes.some((r) => r.path === '/login' && r.methods.get));

assert.ok(routes.some((r) => r.path === '/logout' && r.methods.get));

assert.ok(routes.some((r) => r.path === '/callback' && r.methods.post));

assert.ok(routes.some((r) => r.path === '/callback' && r.methods.get));

aks96 · 2026-01-09T06:53:49Z

Here the chnages doesn't resolve the core issue of express-specific dependencies. express() return the application not the router. This changes the behaviour of sdk. We can improve this by have detection mechanism for framework. But the above solution will breaking change.

use express() instead of express.Router()

11b73e3

phonzammi requested a review from a team as a code owner March 14, 2024 20:48

phonzammi had a problem deploying to external March 14, 2024 20:48 — with GitHub Actions Failure

Merge branch 'master' into master

cb5fa24

kushalshit27 requested a review from a team as a code owner July 18, 2025 06:26

kushalshit27 requested review from Copilot and removed request for a team July 18, 2025 06:27

Copilot AI reviewed Jul 18, 2025

View reviewed changes

kushalshit27 added 2 commits July 22, 2025 16:28

Merge branch 'master' into master

000375b

Merge branch 'master' into master

7e2b45f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

use `express()` instead of `express.Router()`#604

use `express()` instead of `express.Router()`#604
phonzammi wants to merge 4 commits intoauth0:masterfrom
phonzammi:master

phonzammi commented Mar 14, 2024 •

edited

Loading

Uh oh!

phonzammi commented Apr 25, 2024

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jul 18, 2025

Uh oh!

Copilot AI Jul 18, 2025

Uh oh!

aks96 commented Jan 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

	const router = new express();
	const router = express.Router();

-    assert.ok(router._router.stack.some(filterRoute('GET', '/login')));
-    assert.ok(router._router.stack.some(filterRoute('GET', '/logout')));
-    assert.ok(router._router.stack.some(filterRoute('POST', '/callback')));
-    assert.ok(router._router.stack.some(filterRoute('GET', '/callback')));
+    const routes = getRoutes(router);
+    assert.ok(routes.some((r) => r.path === '/login' && r.methods.get));
+    assert.ok(routes.some((r) => r.path === '/logout' && r.methods.get));
+    assert.ok(routes.some((r) => r.path === '/callback' && r.methods.post));
+    assert.ok(routes.some((r) => r.path === '/callback' && r.methods.get));

Conversation

phonzammi commented Mar 14, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing

Checklist

Uh oh!

phonzammi commented Apr 25, 2024

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

aks96 commented Jan 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

phonzammi commented Mar 14, 2024 •

edited

Loading