即使用户已登录，Loopback仍会引发accessToken undefined

Question

I´m working on a loopback JS app with the angular JS SDK on frontend. I have an after hook on a the find remote method for a model which verifies if there is an access token on the current context.

  Team.afterRemote('find',function(context,boards,next){
      var ExeboardUser = app.models.ExeboardUser;
      var ExeboardUserBoard = app.models.ExeboardUserBoard;


      var ctx = loopback.getCurrentContext();

      var at = ctx.get('accessToken');
      if(at==undefined || at==null){
        // return 401
        console.log("Unauthorized: Find Boards-User not logged in.");
        var newError = new Error("Unauthorized: Find Boards");
        newError.status = 401;
        next(newError);
      }
      else{
        //.. more verifications and operations on the data
      }

  });

This verification works well.... Sometimes. The problem I´m having is that at random times I get a 401 Unauthorized because loopback got an undefined access token. This happens even though I´m logged in, and if I send again the request the token magically reappears and the permissions are granted.

I don´t know exaclty how to replicate every time this error. I just know it happens (sometimes) if I leave the session iddle for 5-10 minutes, or if I´m making changes to the frontend and I do a refresh.

On angularJS I call the endpoint at the beggining of my controller. This means that I make the request as soon as the user enters the url which has the controller.

var getTeam = function(){
  Team.find({filter:{where:{ id:$stateParams.id }}})
    .$promise
    .then(function(response){
        $log.log("SUCCESS",response);

      },
      function(err){
        $log.log(err);
      });
};

What I can´t understand is why it happens sometimes and sometimes doesn´t. Can anyone help me spot the error?

Answer 1

Instead of a remote hook, you should use the following ACL on your model:

{
  "accessType": "EXECUTE",
  "principalType": "ROLE",
  "principalId": "$unauthenticated",
  "permission": "DENY",
  "property": "find"
}

Answer 2

Can you please check the following?

1. Order of token and context middleware in server.js file. I have this order:

    app.use(loopback.context()); app.use(loopback.token()); 

2. Check in console to know the location of stored access token, localStorage or sessionStorage . sessionStorage gets removed when you close the browser tab.

I cannot use comment feature yet as my reputation is not yet 50 :). Apologies, if this looked more like comments.