Express Spring SecurityEnterprise Spring Security 6 for Express & TypeScript

Name: Express Spring Security
Author: Eyob Hailu

Enterprise-grade authentication, fluent URL authorization, and declarative method security for modern Node.js.

🔒

Fluent Security Filter Chain

Declarative URL authorization with Ant-style path matchers, HTTP method filtering, and first-match-wins semantics matching Spring Security 6.

🧵

ThreadLocal-style request context powered by Node native AsyncLocalStorage. Access the authenticated user anywhere without drilling req.

🛡️

Method-level security compatible with both Stage 2 (legacy) and Stage 3 (TC39 TS 5+) decorators with automatic this binding and dynamic predicates.

🚦

Clean separation of concerns between AuthenticationEntryPoint (401 Unauthorized) and AccessDeniedHandler (403 Forbidden).

🔑

Unopinionated contract (encode & matches). Zero forced hashing dependencies—use bcrypt, argon2, or your preferred library.

🏢

Supports symmetric HMAC secrets (HS256), RSA/ECDSA public PEM keys (RS256, ES256), and dynamic JWKS key resolvers for Auth0, Okta, and Keycloak.

Created & Maintained by Eyob Hailu

Zero Framework Lock-in • Built for Express 5.x • Pure TypeScript 5.0+