This question is for anyone who is familiar with
- Node.js
- Express
- Passport
- JWT Authentication with passport (JSON Web Tokens)
- Facebook OAuth2.0 OR Google OAuth2.0
I have been doing some online courses and understand how to do the two following things:
- Authentication using Passport Local Strategy + JWT Tokens
- Authentication using Passport Google/Facebook Strategy + Cookie/sessions.
I am trying to combine the content from these two courses basically. I want to use Google Strategy + JWT Authentication. I want to use JWT instead of cookies because my app is going to be a web/mobile/tablet app, and I need to be accessing the api from different domains.
There are two issues I am having with this:
To kick off the Google/facebook OAuth pipelines, you need to call either ‘/auth/facebook’ or ‘/auth/google’. Both Oauth flows work basically the same so when I say ‘/auth/google’ from now on, I am referring to either. Now the issue I’m having is: On the client, do I call the ‘/auth/google’ route with a href button link or an axios/ajax call? If I use the href or axios/ajax approach I am still getting problems with both solutions.
The href approach problem:
When I assign an <a>
tag with a href to ‘/auth/google’ the authentication works perfectly fine. The user gets pushed through the Google Auth flow, they log in and the ‘/auth/google/callback’ route gets called. The problem I have now is how do I correctly send the JWT token back to the client from ‘/auth/google/callback’?
After a lot of googling I have seen that people have simply passed the the JWT back to the client from the oauth callback in the redirect query param. For example:
res.redirect(301, `/dashboard?token=${tokenForUser(req.user)}`);
The issue I have with this is that now the the ability to authenticate is saved in my browser history! I could log out (destroying the token saved in localStorage), and then simply look at my browser url history, go back to the url that contains the token in the query param, and I would automatically log in again without having to go through the Google Strategy! This is a huge security flaw and is obviously the incorrect way to approach it.
The axios/ajax approach problem:
Now before I explain the problem with this issue, I know for sure that If I get this working, it will solve all issues I was having with the previous href problem. If I manage to call ‘/google/auth’ from an axios.get() call and receive the JWT in the response body, I will not be sending the token as url param, and it will not get saved in the browser history! Perfect right? well there is still some problems with this approach 🙁
When try to call axios.get('/auth/google')
I get the following error:
How I’ve tried to solve the problem:
- I installed cors to my npm server, and added
app.use(cors());
to my index.js. - I took a stab and added “http://localhost:3000” to the “Authorised JavaScript origins” in Google developer console.
Neither of these solutions solved the issue, so now I really feel stuck. I want to use the axios/ajax approach, but I’m not sure how to get past this cors error.
Sorry for such a long message, but I really felt I had to give you all the information in order for you to properly help me.
Thanks again, looking forward to hear from you!
3
Answers
I solved this in this way:
I hope it helps. I implemented this multiple times and it showed like a good solution.
The solution I found was to do the OAuth flow in a pop-up (
window.open
), that makes use of a pre-defined callback to pass the token to the front-end upon successful authentication.Below are the relevant code samples, taken from this tutorial:
https://www.sitepoint.com/spa-social-login-google-facebook/
Here is the pre-defined callback and initial open method, called from your front-end:
And here is what your OAuth Callback URL should return, upon successful authentication (which is the last step/page inside your pop-up):
Your token would now be available to your front-end’s pre-defined callback function, where you could easily save it in localStorage.
I suppose though, you could do the OAuth flow in the same window then (sans pop-up) and return an HTML page (similar to the above) that just saves the token and redirects the user to a dashboard immediately.
If your front-end domain was different from your api/auth server, however, you would probably need to redirect from your api/auth server to your front-end with a single-use, time-sensitive token (generated by your api/auth server), that your front-end could then use to call and receive (with axios) your actual token. This way you wouldn’t have that browser history security problem.
Though there is good answer, I wanted to add more information with example.
To disable session we need modify our redirect router. For example if we have redirect path /google/redirect like following, we need to pass { session: false } object as parameter.
So where does this user come from? This user comes from passport’s callback function. In the previous snippet we have added passport.authenticate(….) This middlewire initiates passport’s google-strategy’s callback which deals with the user. For example
That’s it. We have successfully combined JWT and Google/Facebook Strategy.