Passport.js Azure AD 身份验证总是第二次失败

Question

So i'm using Passport.js in Express to authenticate users in an app with the passport-azure-oauth2 strategy.

The first login works fine, the Microsoft portal takes me back to /cb which is

app.get("/cb", auth.passport.authenticate("provider", {
    successRedirect: "/",
    failureRedirect: "/login"
}), function (req, res) {
    res.redirect("/");
});

And it successfully redirects me to '/'. At this point I can log out 'Logged in' via this

if(req.isAuthenticated()) {
    console.log('Logged in');
} else {
    console.log('Not logged in');
}

The issue comes when I either log out and try and log back in again, or try and log in with a different browser. The Microsoft portal always takes me back to '/login', leaving me in a loop.

The login script is simply:

app.get('/logout', function(req, res) {
    req.logout();
    res.redirect('/');
});

On Chrome, when I log in (even successfully) it logs an error: Set-Cookie header is ignored in response from url: https://login.microsoftonline.com/common/login. Cookie length should be less than or equal to 4096 characters. Set-Cookie header is ignored in response from url: https://login.microsoftonline.com/common/login. Cookie length should be less than or equal to 4096 characters.

I'm guessing the issue might be something to do with this? But i've tried everything I can think of to no avail.

Answer 1

it's been a while since you have asked this, but maybe it could be helpful for someone else.

After a day of debugging i found out that the service worker of my react app was messing with the passport authentication strategy.

As you have described, when you load the page for the first time the service worker is not registered yet, but when you get redirected to the homepage the script in the index.jsx enable the worker in the browser (i used it to display the install app button on chrome), so if you logout and try to login again this issue comes along.

If you are in a rush i suggest you to temporary disable the worker if it's not very important for the right functioning of your app and you'll see that everything works fine.

It works on localhost because the script detects your environment and it does not start.

Unfortunately i have not found a permanent solution yet.