search

oauthjs / node-oauth2-server

Complete, compliant and well tested module for implementing an OAuth2 Server/Provider with express in node.js
https://npmjs.org/package/oauth2-server
MIT License
4.01k stars 931 forks source link

This project is back under active development and maintenance! #621

Open thomseddon opened 4 years ago

thomseddon commented 4 years ago

Hello!

After a hiatus following the 3.0.0 release, I'm very happy to say that I will am planning to pick up the maintenance and development of this project. The point of this issue is to outline the plan.

History

3.0.0 was released in August 2017, when the project was already 4 years old, and was the result of a great amount of effort from a number of people in iterating towards a much improved codebase and documentation. Unfortunately, following this all of us who were involved in the release became rather busy with projects elsewhere and were not able to continue to work on the project. As such, we've been stuck on 3.0.0 since then!

I put out a request for maintainers in 2019, although I did receive a few responses I didn't find anyone who was able to start in earnest. The action that drew most traction was a complete rewrite of the project in typescript in #564 - this was great to see, as was the amount of attention it got which showed there were still a good number of people using or interested in the project. However, after observation of the progress of that project it's clear that the maintenance is still one of the hardest parts of such a project and I can understand why anyone would struggle to take that on. I realised that another big rewrite really wasn't what the project needed.

A change in my working situation has left me with a little more time to spare, I've been mostly using this on another OS project of mine (https://github.com/thomseddon/traefik-forward-auth) but I'd like to try and pick up this project too.

Plan

In summary:

A lot of people have been lingering on the 3.0.0 release for a long time and has certainly been battle tested. We've amassed over 100 issues and 22 PRs for this release so I would like to make a big effort to give v3 the fixes it deserves. I have already started this by updating all dependencies and releasing 3.0.2 🎉 In honour of the backwards compatibility, I will also be maintaining support for node 4/6/8 in v3.

Due to the nature of the project, most changes do change the server behaviour and so can be considered "backwards incompatible". To help prevent any jarring changes, the plan is for a v4 release which is as backwards compatible as possible. My goal is to keep the integration entirely backwards compatible, so there should be no client code changes required at all for this entire release. We will drop support for EOL node.js version 4/6/8 and plough through as many fixes and improvements as possible.

Thanks for your patience over the years, I'm already enjoying getting stuck back in again!

Uzlopak commented 4 years ago

Will v4 based on v5?

thomseddon commented 4 years ago

No, it will be based on v3 and be mostly backwards compatible with existing code

Uzlopak commented 4 years ago

Is it planned to implement those changes from v4 also in v5 or is v5 now dead?

mayrbenjamin92 commented 4 years ago

So are you planning to "throw-away" all of the efforts that went into v5? Isn't Typescript meanwhile the de-facto standard for writing larger JavaScript-based projects?

thomseddon commented 4 years ago

All code has bugs - with v3 we have a somewhat battle hardened release with over 100 issues/PRs raised in this repo outlining many real bugs, doc issues and proposed features.

Whereas v5 is a massive rewrite with significantly less review in comparison - it may address some existing bugs, but will undoubtedly introduce new bugs.

As mentioned above, In the interest of forward momentum I'd like to fix the bugs and make the project better 👍

jankapunkt commented 4 years ago

Thanks a lot for going this path. It's great to see, that I can continue to rely on this package. Is there a way to send a small donation :moneybag: to show some :heart:

desaijay315 commented 4 years ago

We are with you. Thank you so much for the support and the awesome work you are doing?

Rmannn commented 4 years ago

Is v5-dev branch really dead ? As i understand, typescript version is not any more in the roadmap.

It's true, it's important to be backward compatible, but it's also important to move forward and update the code to support latest features of oauth2.

Some of thoses features were implemented in v5-dev and we were waiting for those to be merged. Better typing, Pkce was also one of them. Can we expect to get it soon ?

You talk about v4, but we didn't see any branch related to it. Is this really planned ?

We know it's important to get help. How can we help you to move forward ? We just won't want to write code that is going to be "throw-away" like in v5-dev.

jankapunkt commented 4 years ago

I think it would be great to have a v4 branch and a v4 project that contains all the issues relevant for v4. By doing so we know where to put our efforts in.

@thomseddon what do you think?

thomseddon commented 4 years ago

👍 3.1 will be released next week (3.1.0-rc1 is published on npm now)

The existing next branch was actually pegged for v4 and includes some necessary breaking changes. I'll create a new v4 branch shortly which will be based on the existing next branch, rebased from master/v3-catchup (#629)

I'm hoping to merge the existing PKCE PR into v4 too.

For those that have asked about sponsorship - thank you so much, I'd really like to spend more time on this project (there's a lot of work to do :) and I've setup github sponsorship, so for anyone who would like to help in that way it would really allow me to focus more time into this and would be greatly appreciated.

gabriprat commented 3 years ago

Hi! Any news on PKCE implementation?

Uzlopak commented 3 years ago

This Project is imho again dead.

jankapunkt commented 3 years ago

I think there should be someone getting sponsored to tackle the remaining issued or at least to manage incoming PRs.

night commented 3 years ago

@thomseddon honestly i'd say put v3 into maintenance mode (security fixes only), skip v4, and start pushing forward on v5 /w typescript and breaking changes. it's daunting work to build out improvements for 3 separate versions. if you don't have much time then reducing the surface area will surely help, and the typescript branch seems much cleaner to work with and build upon.

ukneeq commented 3 years ago

Is there a branch already for v4?

jankapunkt commented 3 years ago

I agree with @night that managing 3 versions is a huge effort and maybe also the reason this repo getting stuck again?

@ukneeq I think it's the dev branch

Uzlopak commented 3 years ago

I dont think, that the complexity is the reason that this project got stuck again. I suppose when @thomseddon was claiming that this project is under active development and maintenance, that he was in a jobless situation and thats why it was back under development... But soon after he was again busy with a job which supplies him with money. And so this Project is stuck again. I mean it is totally understandable, I would also be less productive in an open source project, if I have a paid Job.

What you gonna do? Issue is also, that this is a security relevant product. If you have a not trustworthy contributor/maintainer which puts malicious code into the product, then alot of companies will be hackable. But on the other hand, we can have a critical community and make it necessary to have x approvals before the maintainers can actually merge into master. I would also agree that new maintainers need to disclose their identities and who their employers are, so that making them to be maintainers does not mean to make a malicious anonymous able to taint the code.

I would be happy if I could support this Project.

jankapunkt commented 3 years ago

I Support the Idea

HappyZombies commented 3 years ago

If you are still in need of maintainers let me know, I really enjoy using this module and would be happy to contribute and improve it as much as I can!

Uzlopak commented 3 years ago

Maybe we should Talk with another group Like auth0 and ask if they fork it and maintain it with our community support.

HappyZombies commented 3 years ago

>This project is back under active development and maintenance!

Sooo that was a lie.

jankapunkt commented 3 years ago

Would be great to have at least some kind of election for maintainers so this can continue to stay alive.

jorenvandeweyer commented 3 years ago

I think there would be a lot of people willing to maintain this project. The only thing that is missing are specifics tasks or todos that people can assign to themselves.

Personally I think the typescript version (v5) should be picked up again.

jankapunkt commented 3 years ago

If we could define some reliable criteria for someone becoming a trusted maintainer we could start elections and @thomseddon only needs to add them. I think from there we could work in fixes for 3.x and 5.0 as well

The trusted maintainers can assign taks, review and merge PRs

svrnwnsch commented 3 years ago

I think the minimal effort should be to at least merge in updated dependencies e.g.: https://github.com/oauthjs/node-oauth2-server/pull/677 and similar

Uzlopak commented 3 years ago

I wrote this today to auth0:

Hello Auth0 Dev Team,

I wanted to ask you if your developers could fork the node-oauth2-server project on github.

https://github.com/oauthjs/node-oauth2-server

Alot of products use this project but the maintainer of the project abandoned it. We, the community, provided various PRs for this product, but till today the maintainer does not merge anything. We discussed about forking off the project, but tbh. this product is too security sensitive to have it maintained by the community in a noname github repo.

I personally would prefer if auth0 would be the trustworthy maintainer of the product. So you would fork the project and continue it as e.g. auth0/node-oauth2-server. We, the community, could then provide PRs and could have atleast some progress.

I hope you join us in the discussion on github:

https://github.com/oauthjs/node-oauth2-server/issues/621

Thank you very much!!!

Best Regards Aras Abbasi

Uzlopak commented 3 years ago

I wrote an identical E-Mail to the CEO of auth0.

Lets hope this project gets finally the love it needs. :)

Uzlopak commented 3 years ago

Hi Aras,

Thank you for thinking of Auth0 when considering trustworthy open source maintainers.

From a quick glance, the main project’s aim appears to be implementing an OAuth2’s authorization server in Node, so that developers can host that function themselves in their codebase.

While that is an approach that has its rightful place in a number of scenarios, we believe that in the more general cases developers are better served by offloading authentication to a service- where they can rely on experts and cloud infrastructure to bear the brunt of the security, availability, manageability, scalability, compliance, interop and change management that are typically very onerous and tricky to achieve in one’s own code, unless identity and security are the core business of the implementer. You can find a summary of our thoughts on the matter here.

As such, I am sure you can see how it would be hard for us to pick on the mantle of maintainer for this project. I do hope you’ll find a viable maintainer, and I look forward to help in case you’ll want to test interoperability with our services!

Best,

Vittorio

So... any other idea how to get this project under "control"?

Rmannn commented 3 years ago

As I said 1 year ago, We started implementing our own version of an oauth2 server with typescript. It's a draft at the moment and does not cover the entire project. However if you want to have a look, you're welcome. It is build to work with Express and Fastify and we are ok to open the project to maintainers. https://github.com/Pop-Code/oauth2

jankapunkt commented 3 years ago

It is build to work with Express and Fastify

We are using sencha/connect so for us this would already be a nogo to add another library just for compatibility reasons.

jankapunkt commented 3 years ago

So... any other idea how to get this project under "control"?

@Uzlopak Under "control" would only mean to either hard-fork, use a new project (as proposed by @Rmannn ) or get @thomseddon or @nunofgs to add a few people as new core contributors. I personally prefer the last one, however this might be the least realistic option at the moment.

HappyZombies commented 3 years ago

Hi Aras, .... So... any other idea how to get this project under "control"?

Sad but I understand why Auth0 wants us to use their software and not let us (non experts lol) make our own implementation. It is a business after all and they don't wanna be held responsible for anything that might go wrong.

Is there a way to contact @thomseddon other than Github? Maybe a twitter or e-mail so we can get him over here? He doesn't seem that active on Github so he could just be outright not knowing or ignoring this.

We just ask that he gives ownership to someone else who will be dedicated to the project. It's not that hard! Please!

Uzlopak commented 3 years ago

I can also understand this. But on the other hand, we want oauth2 and not openid-connect.

Uzlopak commented 3 years ago

Who wants to contact Thom?

HappyZombies commented 3 years ago

Who wants to contact Thom?

Maybe we should try Twitter first, but I don't have one. Facebook might be too personal lol. I wouldn't be opposed to LinkedIn either, thought that would require to connect with him too. I'll see who'll pull the trigger first before I ask him 🤣

jankapunkt commented 3 years ago

Sent the tweet: https://twitter.com/Kuester_Jan/status/1381520364275179524

jankapunkt commented 3 years ago

By the way - is @thomseddon really the only one with respective permissions regarding this issue? What about

taken from https://github.com/orgs/oauthjs/people

Uzlopak commented 3 years ago

I think this is Just a lose group.

Uzlopak commented 3 years ago

@jankapunkt

Well no feedback. Should we now contact his work email?

jankapunkt commented 3 years ago

@Uzlopak that would be hard on the one side but maybe they know what's going on, since there is even no activity on GitHub at all from him since Feb'21

HappyZombies commented 3 years ago

Hey guys, so any response from anyone? If not I will e-mail their work e-mail first thing tomorrow morning.

ruimarinho commented 3 years ago

Hi Everyone. I was hoping @thomseddon could chime on his intentions and future plans for this project, as ultimately its his project and I'd like to respect his will.

In the interest of keeping this package active and maintained, given a few months have passed without any feedback from Thom, I think it's time for me to add new maintainers to ensure this project remains alive. The risk of having no security fixes has to be balanced with the risk of adding new contributors.

@jankapunkt @HappyZombies @Uzlopak have you discussed short-term and long-terms plans for the project already? Triaging tickets, fixing bugs on existing versions, PCKE support, typescript support and others?

HappyZombies commented 3 years ago

Hey @ruimarinho thanks for getting in on this thread!

We haven't discussed anything extensive, mainly because well....we've been waiting around for a response from someone. But definitely first order of business would definitely be updating dependencies (and of course assuring unit tests pass). Next, since this package hasn't been updated in almost a year, I think it then would be appropriate to address any bugs/triage issues people are having.

After that we should definitely start working on PCKE support (or verifying that the PR that's present is valid), especially since npm audit is throwing a high severity for this module. See Issue #688 and PR: #658

So to recap:

First Order of Business Plans:

Long Term Plans:

@jankapunkt @Uzlopak please feel free to pitch in any other ideas that you guys have. I'm ready to get started whenever!

jankapunkt commented 3 years ago

I'm happy to help with reviewing, Integration- testing builds against our workflow Implementations, GitHub actions and improving documentation, where needed.

ruimarinho commented 3 years ago

The problem now is that I am actually an organization member and not owner, so while I can publish npm packages, I can't add new folks to this repository. @mjsalinger are you able to help here?

mjsalinger commented 3 years ago

Hi everyone - I know a few of you have contacted me along with other owners/maintainers regarding getting this project moving again. Although I've moved on from my last position and don't use this project in my day-to-day anymore, I think it's a great project and would like to see it continue/move on.

I'm not comfortable yet with adding new people to the org, as this is really @thomseddon's baby. If he gives the go-ahead, I'll start to add maintainers. What I can do in the meantime is start to maintain this for a few hours a week, accept PRs from others, review, etc, and get close to a release... I'm a big fan of small, incremental releases that don't break compatibility as much as possible, so rather than try to plan a big v4.0, it may make sense to pick a handful of PRs that we all think are really important, and get the 4.0 out and start iterating from there.

I also think at this point it makes sense to drop support for v2, and only backport critical fixes into v3 if those come up.

I need a week or so to go through the project and start to look at where things at, and start to review the PRs. In the meantime, what do people think are the most important things to be included in a v4?

Let me know what you think of the plan - it may take a few weeks to get going, but I hope we can revive this repo and build a community of maintainers over time. I want to give Thom a chance to chime in, but I'll look to add maintainers in a month or so if we don't hear from him...

Hope we can get this back on track, and then expand the pool of maintainers to help keep this library moving forward.

HappyZombies commented 3 years ago

@mjsalinger Thank you so much for reaching out to us and helping out! We've been trying to contact @thomseddon for awhile now so hopefully we can hear back from him soon. Like I've said I would be happy to be on of the maintainers since I really, well, believe in it and want to see it continue as well! But we will see what he says/happens.

In the meantime, I am 100% on board with the plan of just slowly rolling out a v4 with small releases that don't break anything; this can include any bugs fixes that are on the issue board along with reviewing PRs (updating dependencies, reviewing bug fixes, etc.). I will look over the issue board and PR board to see what I think can/should be included in v4 and make another comment today or in the following days. 👍

I think we can also possibly squeeze in PKCE at the least for version 4, but we will see.

dhensby commented 3 years ago

Looks like @thomseddon is alive (https://github.com/librenms/librenms/pull/12898) so either just is ignoring these mentions or isn't getting them.

I'm potentially looking to use this package in the near future. Either it will be via a fork that is purely for private use or via this if some maintainers pick it up again. I note that @mjsalinger has offered to put some time into maintaining the repo and taking in contributions which is great.

I'd make two points:

  1. Any new maintainers need to be vetted somehow, I don't think it's going to be OK just to take random people who are "interested" in the project on board as maintainers, that kind of decision should be taken cautiously and those that are chosen should have a track-record of maintaining decent sized libraries
  2. If this project does start to see active development again and other maintainers are added, if @thomseddon doesn't come forward with some formal sanctioning of it, I'd be worried that in the future he could come along and revoke those permissions.

In conclusion I'd suggest a proper vetting process for any new maintainers that come forward (or better, that are chosen) and @thomseddon (and any others no longer interested in maintaining the project) being removed from it.

mjsalinger commented 3 years ago

Hi everyone,

So I've spent some time looking at the codebase - and I wanted to propose how I think we should proceed. A few years ago when I was working on this project more actively, I set up dev, 2.x and 3.x brnaches. They've since fallen out of sync, and a 4.0.0-dev.2 has been released (but the commits for that are not in any branch as far as I can see). I think starting to manage all of these different branches may be too complicated, so here is what I propose:

I'm ready to start reviewing/testing/merging and hope to get a -dev.3 release out with at least some minor fixes by end of the week. And I would also like to get PKCE into the 4.0 dev branch but I think that may go into next week (dev.4). I will need some people to volunteer to help test the dev build, as I no longer have an active project that uses this library, and it will take me a little time to throw something together that I can use to do manual testing.

Appreciate everyone willing to volunteer, as I said I'm happy to take this on, but will need support from this community and help where needed to make it successful. Let's do this!

soulchild commented 3 years ago

Thanks for investing the time to get this project going again, @mjsalinger! I'm happy to test any pre-release versions with our application.