0

I have a node.js code that uses passport openId connect strategy for authentication. It redirects back to original URL after authentication, however, if I submit a form with POST while session is expired, then it doesn't redirect back to original URL as a POST operation but changes it to GET request.

I want to know, is there any possible way, where I can store request type and after authentication it does same operation.

my app.js code looks like this:

app.get('/login', passport.authenticate('openidconnect', {})); 

function ensureAuthenticated(req, res, next) {
    if (!req.isAuthenticated()) {
        req.session.originalUrl = req.originalUrl;
        res.redirect('/login');
    } else {
        return next();
    }
}

app.get('/auth/sso/callback',function(req, res, next) {
    var redirect_url = req.session.originalUrl;
    passport.authenticate('openidconnect', {
        successRedirect: redirect_url,
        failureRedirect: '/failure',
    })(req,res,next);
});

PS: Authentication and other general redirects work fine.. the problem is with POST form submission only.

2 Answers 2

2

The problem here is that when executing the original POST request, it (probably) has a body with the post-data. The ensureAuthenticated check redirects to the login page, and thus losing said post-data!

After successful authentication, when you redirect to the original url, there is no way of knowing what post-data to send with the POST request.

One way I can think of is keeping track of the last used GET-request url, store that in the session and use that one in your "after login redirect" and thus returning to the page before submitting the POST request. This means that yes, unfortunately your user has to fill in the form again (since you have to "rebuild" the post data you have lost somehow).

You could do this by adding a use handler early in the app which stores tbe url in the session object if the request is of type GET. I would provide a code snippet for you, but unfortunately im on my mobile phone on vacation, so I'm afraid that might be a bit difficult to do, I'm sorry :(

0
0

I have found a work around for this. What I am doing now is, I am storing POST parameters in the global variables first and then I am calling ensuredAuthentication function.

After ensuredAuthentication function it redirects to original Url as a GET request but since I have the post parameters stored in global variable, I can continue my operations.

Thanks for your idea though.. It is something to try.

3
  • With global variables i hope you mean session-variables, otherwise you're gonna mix up content between users Jul 24, 2016 at 9:38
  • @OlleKelderman, you caught me there... I wasn't talking about session-variables. do you have any example code snippet that you can share, I want to know how to use session-variables for different users for the same function call. Jul 25, 2016 at 14:55
  • Like i stated in my answer im currently on vacation, so mobile only, typing (and more specifically testing) code-snippets is a but difficult :p, but in short: modify req.session like you did with req.session.originalUrl Jul 25, 2016 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .