Passport Strategy: ResponseBodyError

[robireton]

I’m trying to migrate from version 5 to 6 and use the included Passport strategy.

Starting with the provided passport example code, I get a ResponseBodyError in Strategy.authorizationCodeGrant when it calls client.authorizationCodeGrant.

I notice that one of the parameters to client.authorizationCodeGrant is produced by Strategy.authorizationCodeGrantParameters, but that method can only return an empty object.

Can the included Passport strategy work if this is the case?

[panva]

What's the [cause] of your ResponseBodyError?

[panva]

Thanks, but that doesn't answer my question, please handle the error and log its cause.

[panva]

express deprecated req.host: Use req.hostname instead file:/Users/iretonrt/Projects/Sample/node_modules/openid-client/build/passport.js:151:49

this also tells me you probably just need to either

1. upgrade to express@5;r or
2. overload the strategy's currentUrl method to return the correct current URL

Your problem is very likely the same as in #714

[robireton]

Thank you for your attention and assistance. I didn’t know that Express 5 had been released. I’ll probably just stick with openid-client@5 until I can consider migrating to Express 5. I am still puzzled about how the Passport strategy included with openid-client@6 can work when Strategy.authorizationCodeGrantParameters and Strategy.authorizationRequestParams both ignore the options passed to them and return just {}. I would also love to see a working Passport example. The one in the repo doesn’t actually initialize or start Express or use the callbackURL required by Google.

To close the loop on the cause: an Error is not being thrown such that my code can catch and examine it. The error is being written to the console and also appears in the browser.

[panva]

All you have to do is make currentUrl return the current URL of the request incl. its search parameters.

Don't worry about authorizationCodeGrantParameters and authorizationRequestParams, these are used to provide additional / extra parameter to the respective protocol messages.

To explain, the currentUrl prototype method on the Strategy is used to determine the current URL the strategy is executed on, ergo the URL that is used as the redirect_uri token endpoint parameter. And in tls-offloading proxy setups it just depends on express configuration to be in order.

openid-client/src/passport.ts

Lines 378 to 389 in 7405570

	/**
	* Return the current request URL.
	*
	* - Its `searchParams` are used as the authorization response parameters when
	* the response type used by the client is `code`
	* - Its value stripped of `searchParams` and `hash` is used as the
	* `redirect_uri` authorization code grant token endpoint parameter unless
	* callbackURL was specified in the Strategy constructor
	*/
	currentUrl(req: express.Request): URL {
	return new URL(`${req.protocol}://${req.host}${req.url}`)
	}

[robireton]

For what it’s worth, I am specifying callbackURL in my Strategy constructor, so the currentUrl shouldn’t be relevant? The error I’m seeing happens in the route handler for that callback URL.

[panva]

callbackURL from the options is only used as the redirect_uri parameter in the authorization request. Using it as a fixed value during the callback phase would defeat its purpose.

[robireton]

Thanks again for the extra help and the extra attention. Updating my Strategy instance's currentUrl to account for the extra path from my reverse proxy did indeed work. (Now I wonder how my code using openid-client@5 worked with just a fixed redirect_uri?)

[panva]

Glad I could help.