Search code examples
javascriptnode.jsexpressstormpath

retain query string after Stormpath authentication and authorization in node express site

I have a node express app , using express-stormpath for authentication/authorization I have a GET route which is called with certain jquery parameters. If the user is logged in everything is working as expected. If not the user login screen is shown. After stormpath authentication and authorization is done my query params are lost. Is there any way to retain those?

app.get('/myRoute', stormpath.groupsRequired(['admin']), function(req, res){
    console.log('req.query ',req.query);
    //do somehting with the query data
    res.sendStatus(200);
});

after authentication req.query is {}. Any ideas?

Solution

  • Thank you for the question, I work at Stormpath and I'm more than happy to help. Our express-stormpath library is open source, and we're always happy to fix bugs and review pull requests.

    Can you tell me which version of our library you are using? At the moment I'm not able to reproduce the problem you are seeing. Here is a quick example that I put together with the latest version, 3.0.1:

    'use strict';

var express = require('express');
var stormpath = require('express-stormpath');
var app = express();
var port = process.env.PORT || 3000;

app.use(stormpath.init(app));

app.get('/admins', stormpath.groupsRequired(['admins']), function(req, res){
  res.json(req.query);
});

app.on('stormpath.ready',function () {
  console.log('Stormpath Ready');
});

app.listen(port, function () {
  console.log('Server listening on http://localhost:' + port);
});

    With this example, I do the following:

    1.) Assert that I'm not logged in, by deleting all my cookies for localhost.

    2.) Type /admin?foo=bar into the URL bar.

    3.) I am redirected to the login page.

    4.) I login with valid credentials.

    5.) I am redirected to /admins?foo=bar, as expected, and I see the req.query object in the body of the page that is rendered. This is only true if the user is in the admins group, if they are not I will see the "Unauthorized" error message page.

    Can you compare my steps and my example to your application, and let us know if there are any differences? Thanks!