VERISCO Shield Integrate

Framework support

What works with each Node framework today, stated at three honest levels. Outside Node, every framework works the same way, by reading one header.

Outside Node#

Any language and any framework that can read an HTTP header and verify an RS256 signature works in gateway and connector mode. See Read the signed-in user.

Node frameworks#

Framework	Middleware	SDK mode	Notes
Connect	Full	Yes	Same (req, res, next) signature as Express.
Express	Full	Yes	Mounts directly. This is what the middleware is written for.
Fastify	Full	Not yet	Mounts as a native plugin via app.register(). Populates request.user; no @fastify/express needed.
Hapi	Gateway only	Not yet	Different lifecycle. Protected by the gateway; req.user not available yet.
Koa	Gateway only	Not yet	Different context object. Protected by the gateway; req.user not available yet.
NestJS	Needs an adapter	Not yet	Needs a Guard rather than middleware — a different idiom, not a different contract.
Next.js	Needs an adapter	Not yet	Works behind a custom server. The App Router needs a middleware.ts adapter — different runtime, no req.user.

What the levels mean#

Level	Meaning
Full	The middleware mounts as it is and populates the user on each request.
Needs an adapter	The gateway protects your application today. Reading the user in-process needs a small shim that is not shipped yet; verify the header yourself in the meantime.
Gateway only	Your application is protected by the gateway. Verify the header yourself to read the user.

A framework at any level is fully protected in gateway and connector mode. The level only describes how much of the code VERISCO writes for you.

Express and Connect#

JavaScript

const { verisco, protect } = require('@verisco/verisco-middleware');

// Mount before your routes. Populates req.user from the
// verisco_session cookie, verified with your RS256 public key.
app.use(verisco({ publicKeyFile: './config/verisco_public.pem' }));

// Require a signed-in user on a route:
app.get('/dashboard', protect(), (req, res) => res.json(req.user));

Fastify#

JavaScript

const verisco = require('@verisco/verisco-middleware');

// Register before your routes. Populates request.user from the
// verisco_session cookie, verified with your RS256 public key.
app.register(verisco.fastify, { publicKeyFile: './config/verisco_public.pem' });

// Require a signed-in user on a route:
app.get('/dashboard', { onRequest: [verisco.fastifyProtect] },
  async (request) => request.user);

Fastify has no app.use(). The middleware registers as a native plugin and the guard is an onRequest hook; @fastify/express is not needed.

Everything else#

Read X-Verisco-Claims and verify it with jose or any JWT library. The steps are the same as for a non-Node application.

Something missing or wrong on this page? Tell us and we will fix it.