Auth0 & Express-openid-connect /callback not responding

user_18272541 0
Viewed 442

I have a simple node express application running on port 3002 (because 3000 is already used). For logging users in I use Auth0 and the Express-openid-connect package.

Every time I try to log in I get stuck at a blanc page called: Submit This Form, but it doesn't stop loading. The logs in Auth0 always show: successfull login. I can however access non login-protected routes without a problem.

The /callback route throws the following error:

Error: Request aborted
    at IncomingMessage.<anonymous> (/workspace/node_modules/formidable/lib/incoming_form.js:122:19)
    at IncomingMessage.emit (events.js:400:28)
    at abortIncoming (_http_server.js:569:9)
    at socketOnEnd (_http_server.js:585:5)
    at Socket.emit (events.js:412:35)
    at endReadableNT (internal/streams/readable.js:1334:12)
    at processTicksAndRejections (internal/process/task_queues.js:82:21)

but I think that's what it is supposed to do when a request is aborted, right?

My Auth0 setup should be right since it doesn't result in an error.

My Express-openid-connect middleware looks linke this:

require('dotenv').config()
const { auth } = require('express-openid-connect')

module.exports = auth({
    authRequired: false,
    issuerBaseURL: process.env.AUTH0_ISSUER_URL,
    baseURL: process.env.BASE_URL,
    clientID: process.env.AUTH0_CLIENT_ID,
    secret: process.env.AUTH0_SECRET
})

and the env variables:

BASE_URL=http://localhost:3002
AUTH0_ISSUER_URL=...
AUTH0_CLIENT_ID=...
AUTH0_SECRET=H+F/0yW/i4X11EDzAFBZE2iaUTy4jBMo3gBWwXRkoY8W3DJ+E24tnt8Q5y+rF7QO

AUTH0_SECRET is just a random string but I tried it with the client secret provided by Auth0 and it changed nothing.

AUTH0_ISSUER_URL is the correct url since every request shows up in the logs.

AUTH0_CLIENT_ID is the correct client id since the logs show the correct application.

If I manually go to localhost:3002/callback I get the following expected error:

BadRequestError: state missing from the response
    at /workspace/node_modules/express-openid-connect/middleware/auth.js:121:31
    at processTicksAndRejections (internal/process/task_queues.js:95:5)

This means that my /callback route should be reachable and working.

However I can manually copy the parameters and then everything works however this process isn't usefull for production.

I even tried to submit the form manually over the console

document.forms[0].submit()

but it returned undefined and the page didn't stop loading once again.

So for me there is something wrong with the submit() function of that form.

auth0 express node.js openid-connect
1 Answers

My understanding of this is that Express OpenID Connect wraps and handles most of the things so developers would not have trouble to setup the protocol flow. Meaning, you would not need to access /callback by yourself. auth from express OpenID Connect, once it is added in express app, provides our express app /login, /callback and /logout routes. More you can find here https://auth0.com/docs/quickstart/webapp/express.

There are 2 points, in your question that i see, which shall be discussed.

  1. The logs in Auth0 always show: successfull login. I can however access non login-protected routes without a problem.
  1. You should not call /callback by yourself, instead it is part of the flow which is provided by the library (express openID Connect). You can download their sample project and try it yourself: https://github.com/auth0-samples/auth0-express-webapp-sample/tree/master/01-Login. You can see there that /callback route is not added by sample project code. Same goes for /login and /logout routes.

Screenshots after sample project from the link is run:

  • when login is clicked sequence is like this: /login, /callback, and then / enter image description here
  • in network tab you can see more enter image description here
user_84162010
Related