ember-simple-auth oauth2 authorizer issue

Question

I am trying to set up authorization on an Ember App running on a Node.js server.

I am using the oauth2 Authenticator, which is requesting a token from the server. This is working fine. I am able to provide the app with a token, which it saves in the local-storage.

However, when I make subsequent requests, the authorizer is not adding the token to the header, I have initialized the authorizer using the method described in the documentation ( http://ember-simple-auth.simplabs.com/ember-simple-auth-oauth2-api-docs.html ):

Ember.Application.initializer({
  name: 'authentication',
  initialize: function(container, application) {
    Ember.SimpleAuth.setup(container, application, {
        authorizerFactory: 'authorizer:oauth2-bearer'
    });
  }
});

var App = Ember.Application.create();

And I have added an init method to the Authorizer, to log a message to the server when it is initialized, so I know that it is being loaded. The only thing is, the authorize method of the authorizer is never called.

It feels like I am missing a fundamental concept of the library.

I have a users route which I have protected using the AuthenticatedRouteMixin like so:

App.UsersRoute = Ember.Route.extend(Ember.SimpleAuth.AuthenticatedRouteMixin, {
  model: function() {
    return this.get('store').find('user');
  }
});

Which is fetching the data, fine, and redirects to /login if no token is in the session, but the request headers do not include the token:

GET /users HTTP/1.1
Host: *****
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
Accept: application/json, text/javascript, */*; q=0.01
Origin: *****
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36
Referer: *****
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8

Any help you could give me would be greatly appreciated.

Answer 1

Is your REST API served on a different origin than the app is loaded from maybe? Ember.SimpleAuth does not authorizer cross origin requests by default (see here: https://github.com/simplabs/ember-simple-auth#cross-origin-authorization )