PassportJS openid-client How to use without a session, save token/user in normal cookie

Viewed 891

We are currently using the https://github.com/panva/node-openid-client strategy for passportJS, along with cookie-session.

However we would like to try and move away from sessions and just store either a simple cookie with a token, or attach the token to a header on each request which we then introspect to see whether the token is valid.

I can't figure it out, maybe it's not possible, I just simply don't know where or how I can retrieve the token from the openid-client library, and when and how I should save it in a cookie. Maybe it is only built to use a session.

currently we have:

  passport.use(
    `oidc.${site}`,
    new Strategy(
      {
        client,
        params: getParamsForSite(site),
        passReqToCallback,
        usePKCE,
      },
      (tokenset, done) => {
        const user = {
          token: tokenset,
          name: tokenset.claims.sub,
        };

        return done(null, user);
      }
    )
  );

for the login

app.get(['/login', '/login/:site'], (req, res, next) => {
  if (req.params.site) {
    passport.authenticate(`oidc.${req.params.site}`)(req, res, next);
  } else {
    res.end(loginFrontend.success());
  }
});

and for the callback

app.get('/auth_callback', (req, res, next) => {
  passport.authenticate(`oidc.${req.query.state}`, {
    callback: true,
    successReturnToOrRedirect: process.env.BASE_URI,
  })(req, res, next);
});

We would like to continue using this library as the authentication service we call has a discovery endpoint etc. and wouldn't want to implement all of the features ourselves. If I set session to false, how do I retrieve the token and where for this strategy, can someone help me?

0 Answers
Related