accessToken cookie not being set for local-login

[gouthamve]

I was trying to use make an authenticated api call after logging in using the passport-local. But the accessToken signed cookie is not being set for local.

When I login through Fb, I get a signed cookie with accessToken but that is not happening for local. I have added the following option to providers.json for local but still the cookie is not being set.

"setAccessToken": true

Steps to reproduce:
Clone the loopback-example-passport repo and use the local login. You will see that the accessToken is virtually impossible to retrieve.

[JulienCabanes]

Same problem here :(

[JulienCabanes]

I figured out what's going wrong and how to get around:

• Local auth does generate an accessToken but it doesn't set the cookies accordingly as it does with facebook auth. The workaround is to get the last accessToken and set the cookies by hand inside the success callback.

res.cookie('access_token', accessToken.id, {
  signed: req.signedCookies ? true : false,
  maxAge: 1000 * accessToken.ttl
});
res.cookie('userId', user.id.toString(), {
  signed: req.signedCookies ? true : false,
  maxAge: 1000 * accessToken.ttl
});

• There's also an issue with the local signup where req.login() does not generate any accessToken at all, the workaround is to use User.login() after it...

[bryannaegele]

Thank you, thank you @JulienCabanes. This was driving me insane.

I added the following to a boot script as a modification to user.

'use strict';

module.exports = function(app) {
  app.models.user.afterRemote('login', function(context, accessToken, next) {
    let res = context.res;
    let req = context.req;

    if (accessToken != null) {
      if (accessToken.id != null) {
        res.cookie('access_token', accessToken.id, {
          signed: req.signedCookies ? true : false,
          maxAge: 1000 * accessToken.ttl
        });
        res.cookie('userId', accessToken.userId.toString(), {
          signed: req.signedCookies ? true : false,
          maxAge: 1000 * accessToken.ttl
        });
      }
    }
    return next();
  });

  app.models.user.afterRemote('logout', function(context, result, next) {
    let res = context.res;
    res.clearCookie('access_token');
    res.clearCookie('userId');
    return next();
  });
};

[adnanshatil]

It works fine for me during login ... but not in logout

This is because app.models.user.afterRemote method's callback function ...
context.result always returns null. as a result res.clearCookie fails.

Well, I was looking into some other issues related to mysql and I think that this is the same.
It worked nicely with built-in User model.

But I have created People model extended from User and mysql is the data storage. Then it is creating problem.

How can I solve this?

[gausie]

I am currently not using sessions and would ideally like the accessToken to be appended to the success callback route in some way (in req.authInfo for example). Is that possible?

[superkhau]

@bajtos @raymondfeng @ritch I'm not sure about this one, PTAL.

[jamesjjk]

+1 local login is not setting cookie for accesstoken or returning token req.accessToken. Does not allow for local-login to be used.

[phuongnl]

Same problem, i dont know how to get access token when use passport local.

[phuongnl]

I found the solution, install cookie-parser, add this line to server.js: app.middleware('session:before', loopback.cookieParser(app.get('cookieSecret')));.
after successRedirect to "/auth/account", in this router u can get accesstoken by req.cookies.accessToken.

[jamesjjk]

@phuongnl but the cookie is not set client side. There is a problem with the callback for passport local

[phuongnl]

@jamesjjk yes, we need other solution.

[gshireesh]

i added the following change and it is working for me now.

master...gshireesh:master

then add

{
  "local": {
    "provider": "local",
    "module": "passport-local",
    "usernameField": "email",
    "passwordField": "password",
    "authPath": "/auth/local",
    "successRedirect": "/auth/account",
    "failureRedirect": "/local",
    "failureFlash": true,
    "setAccessToken" : true,
    "session" : true,
    "forceDefaultCallback" : true
  }
}

to the providers.json

the logout code will be

app.get('/auth/logout', ensureLoggedIn('/login'), function (req, res, next) {
  req.logout();
  var accessToken  = req.accessToken || "";
  if(accessToken){
    console.log('found access tocken', accessToken.id);
    var User = app.models.User;
    User.logout(accessToken.id, function (err) {
      console.log(err || 'Logged out');
    });
  }
  else{
    console.log("unable to find the access token");
  }
  res.redirect('/');
});

Hope it works for you too :)