jaredhanson / jaredhanson/oauth2orize

Token middleware does not call application server's "next"

Open
#216 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
3.5k
Forks
472
PR merge metrics
No merged PRs in 30d

Description

I'm using oauth2orize v1.0.1 with restify. The server is configured to use the token middleware as such:

var oauth2orize = require('oauth2orize');
var oauth2Server = oauth2orize.createServer();

server.post('/oauth/token',
      passport.authenticate('oauth2-client-password', { session: false }),
      oauth2Server.token(),
      oauth2Server.errorHandler()
);

The server is also configured to log after the server has finished processing a response.

server.on('after', function(req, res) {
    var responseLog = {
        type: 'response',
            method: req.method,
            path: req.path(),
            route: req.route && req.route.path
        };

    req.log.info(responseLog);
});

However, the logging code is not executed after /oauth/token requests. This is because the token middleware doesn't call restify's "next" method unless there's an error. You can see this if you add an additional middleware after oauth2Server.token().

var oauth2orize = require('oauth2orize');
var oauth2Server = oauth2orize.createServer();

server.post('/oauth/token',
      passport.authenticate('oauth2-client-password', { session: false }),
      oauth2Server.token(),
      function(req, res, next) {
            console.log('after token middleware'); // this doesn't get executed
            next();
      }
      oauth2Server.errorHandler()
);

I believe the token middleware should always call restify's "next" regardless of whether there's an error.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the oauth2Server.token() middleware entry point and reproduce the request with the additional middleware shown in the issue. Verify that the middleware invokes restify's next callback on both successful and error paths, and confirm that the following middleware and the server's after handler run.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.