I'm loading the built-in token middleware once globally (all verbs, all paths) during the "auth" phase. However, for the use-case of linking multiple accounts (e.g. via OAuth) - and due to the fact, that my primary auth mechanism is not cookie-based - I'm also loading the token middleware specifically on the callbackPath for my auth providers. The latter instance of the middleware is configured to only check for a provider-specific cookie (which is set when accessing the authPath) - and is supposed to use that to fill req.accessToken. The cookie expires within a configurable amount of minutes and gets removed when the callbackPath is requested.
Digging in the code, I found that the token middleware skips when req.accessToken !== undefined. Unfortunately, if the first instance of the middleware can not find valid credentials, it assigns req.accessToken = null (which is !== undefined).
In your tests you say that it "should skip when req.token is already present" - which is not the case when set to null.
Am I missing a switch somewhere?
Would you guys be okay with an PR to change the condition from req.accessToken !== undefined to req.accessToken && req.accessToken.id?
I'm loading the built-in token middleware once globally (all verbs, all paths) during the "auth" phase. However, for the use-case of linking multiple accounts (e.g. via OAuth) - and due to the fact, that my primary auth mechanism is not cookie-based - I'm also loading the token middleware specifically on the
callbackPathfor my auth providers. The latter instance of the middleware is configured to only check for a provider-specific cookie (which is set when accessing theauthPath) - and is supposed to use that to fillreq.accessToken. The cookie expires within a configurable amount of minutes and gets removed when thecallbackPathis requested.Digging in the code, I found that the token middleware skips when
req.accessToken !== undefined. Unfortunately, if the first instance of the middleware can not find valid credentials, it assignsreq.accessToken = null(which is!== undefined).In your tests you say that it "should skip when req.token is already present" - which is not the case when set to
null.Am I missing a switch somewhere?
Would you guys be okay with an PR to change the condition from
req.accessToken !== undefinedtoreq.accessToken && req.accessToken.id?