Easier local debugging for OAuth2 providers #1988

nriesco · 2020-06-09T08:07:57Z

The problem

When doing local tests in order to try/test external OAuth2 service providers, it gets really hard to work with localhost on NODE_ENV that are not 'development' or 'test'.

It would be very simple and a big deal for local testing to instead of forcing http/https and port number based on the environment name, to be able to set it in the config file.

The code:

feathers/packages/authentication-oauth/src/index.ts

Lines 34 to 42 in 3215714

    
           let protocol = 'https'; 
        
           // Development environments commonly run on HTTP with an extended port 
        
           if (app.get('env') === 'development') { 
        
             protocol = 'http'; 
        
             if (String(port) !== '80') { 
        
               host += ':' + port; 
        
             } 
        
           }

What could be done:

Replace: let protocol = 'https';

With: let protocol = get('protocol') || 'https';

And remove:

  // Development environments commonly run on HTTP with an extended port
  if (app.get('env') === 'development') {
    protocol = 'http';
    if (String(port) !== '80') {
      host += ':' + port;
    }
  }

daffl · 2020-06-09T18:16:41Z

You should already be able to overwrite host and protocol in the oauth configuration settings defaults:

{
  "authentication": {
    "oauth": {
      "redirect": "/frontend",
      "defaults": {
        "host": "localhost",
        "protocol": "https"
      },
      "google": {
        "key": "...",
        "secret": "...",
        "custom_params": { "access_type": "offline" }
      },
      "twitter": {
        "key": "...",
        "secret": "..."
      }
    }
  }
}

nriesco · 2020-06-10T06:25:08Z

I tried that but is not just the protocol, is also that is not using the same port. For instance I run a server locally that has a different config (it will connect to a remote database) so is not my development environment but my "local-remote" environment.

That will create an OAuth callback link like this: http://localhost/oauth/google/authenticate instead of http://localhost:3000/oauth/google/authenticate.

Maybe, to avoid potencial security issues (ensuring https, etc.), the appropriate solution would be to change this line:

feathers/packages/authentication-oauth/src/index.ts

Line 37 in 3215714

if (app.get('env') === 'development') {

From: if (app.get('env') === 'development') { to if (app.get('env').indexOf('development') !== -1) {

That way any development-something environments could behave that way (I would change mine to development-remote in that case.

feathersjs / feathers

Easier local debugging for OAuth2 providers #1988

Easier local debugging for OAuth2 providers #1988

nriesco commented Jun 9, 2020

daffl commented Jun 9, 2020 •

edited

nriesco commented Jun 10, 2020

feathersjs / feathers

Sponsor feathersjs/feathers

Join GitHub today

Easier local debugging for OAuth2 providers #1988

Easier local debugging for OAuth2 providers #1988

Comments

nriesco commented Jun 9, 2020

The problem

The code:

What could be done:

daffl commented Jun 9, 2020 • edited

nriesco commented Jun 10, 2020

Essential cookies

Always active

Analytics cookies

daffl commented Jun 9, 2020 •

edited