title: Secured nodejs backend API's using keycloak
body: <p>I'm implementing a Nodejs backend API's. Some of them are need to authenticate before access. for that I choose keycloak server as identity server. I used npm keycloak-connect library to integrate node server and the keycloak server.
  Now the authentication are woking fine. </p>
  
  <p>problem is when I logout from keycloak server by using '<em><a href="http://localhost:8080/auth/realms/test-realm/protocol/openid-connect/logout" rel="nofollow noreferrer">http://localhost:8080/auth/realms/test-realm/protocol/openid-connect/logout</a></em>' this API. keycloak server says token is not valid anymore. But when I used the same taken to access Node server it takes that token as valid token.</p>
  
  <pre><code>'use strict';
  
  const Keycloak = require('keycloak-connect');
  const express = require('express');
  var cors = require('cors')
  const app = express();
  
  app.use(cors())
  
  
  var keycloakConfig ={
    "realm": "test-realm",
    "auth-server-url": "http://localhost:8080/auth",
    "ssl-required": "external",
    "resource": "test-dev-api",
    "public-client": true,
    "confidential-port": 0
  }
  
  var keycloak = new Keycloak({},keycloakConfig);
  
  app.use( keycloak.middleware( { logout: '/logout'} ));
  
  app.get('/secured-echo', keycloak.protect(), function(req,resp) {
    resp.send("Secured Hello");
  });
  
  //unprotected route
  app.get('/echo', function(req,resp) {
    console.log(keycloakConfig)
    console.log(keycloak)
    resp.json({"say": "hello"});
  });
  
  app.listen(4000, function () {
    console.log('Listening at port:4000');
  });
  </code></pre>