使用PassportJS和Express重定向后如何保留会话数据

Question

I'm trying to redirect user to the originally issued URL after authenticating them to our own oauth2 server. To do so I've read that it is possible to store data in the session object attached to the request. However I'm losing the data after the first redirect and consequently user are redirected to the fallback URL I provided.

Here is the code that initialize the app

const express = require('express');
const bodyParser = require('body-parser');
const cors = require('cors');
const session = require('express-session');
const cookieParser = require('cookie-parser');
const auth = require('./auth');

const app = express();
const router = express.Router();

app.use(cookieParser());
app.use(bodyParser.urlencoded({ extended: true }));
app.use(bodyParser.json());
app.use(cors());
app.use(session({
  secret: 'keyboard cat',
  cookie: {
   secure: true,
   maxAge: 36000000
  },
  resave: false,
  saveUninitialized: true
}));

auth.config(app);

app.get('/', (req, res) => res.json({ message: 'root' }));
app.get('/failure', (req, res) => res.json({ message: 'fail' }));

// load all the routes
require('../routes/posts')(router, auth);

app.use('/api', router);
app.use('/auth', auth.router);

The auth module is as follows :

const express = require('express');
const passport = require('passport');

const router = express.Router();

module.exports = {
  config (app) {
    passport.serializeUser((user, done) => done(null, user));
    passport.deserializeUser((obj, done) => done(null, obj));

    passport.use(new OAuth2Strategy({
      authorizationURL,
      tokenURL,
      clientID,
      clientSecret,
      callbackURL
    },
    onAuthorize
    ));

    app.use(passport.initialize());
    app.use(passport.session());

    router.get('/uaa', passport.authenticate('oauth2'));

    router.get('/oauth/callback', passport.authenticate('oauth2'), (req, res) => {
        req.session.save(err => {
          if (err) throw err;
          res.redirect(req.session.redirectTo || '/');
        });
      });
  },

  ensureAuthenticated (req, res, next) {
    if (req.isAuthenticated()) return next();
    if (!req.session.redirectTo) req.session.redirectTo = req.originalUrl;
    req.session.save(err => {
      if (err) return next(err);
      res.redirect('/auth/uaa');
    });
  },

  router
};

And now if on the browser I request http://localhost:3333/api/questions (the matching route descrition is router.route('/questions').get(auth.ensureAuthenticated, PostController.questions.getAll) ) I land in the ensureAuthenticated function which stores the initial route ( /api/questions ) but when I land in the final handler for my oauth2 callback, req.session.redirectTo does not exists. In fact it no longer exist right after the redirection to /auth/uaa .

• Am I configuring something wrong ?
• Are my router declarations okay ?
• Why can't I access the data I previously stored ?

Thank you.

Answer 1

这里的问题是我在通过HTTP提供内容时指定了一个安全cookie。