If you have built an Express API, you know the frustration: you authenticate a token, attach user data to req.user, and spend the rest of the day drilling req down through controllers, domain services, repositories, and helper functions.
The usual alternative is migrating to NestJS just to get decent guards and decorators—which drags an entire Angular-style dependency injection framework into your project.
Java developers have had this solved for years with Spring Security's ambient execution context and declarative filter chains.
I built express-spring-security to bring that architecture natively to Express 5 and TypeScript without any framework bloat.
Key Capabilities
- Ambient Security Context (
AsyncLocalStorage): Access the authenticated user anywhere in your backend call stack viaSecurityContextHolder.getContext().getAuthentication()without passing thereqobject. - Declarative Security Filter Chain: Define all your public, authenticated, and role-protected routes in one clean configuration block instead of scattering middleware across router files.
- Method-Level
@PreAuthorize: Secure individual controller methods with clean expression-based checks likehasRole('ADMIN'). - Zero Bloat: Runs natively on Express 5.x with zero heavy DI containers.
Quick Links
- 📦 npm:
npm install express-spring-security - 📖 Interactive Docs & Visual Architecture: https://eyob-hailu.github.io/express-spring-security/
- ⭐ GitHub Repository: https://github.com/eyob-hailu/express-spring-security
Would love to hear your thoughts and feedback!
