Search code examples
node.jscookiesjwtpassport.jssupertest

How to test authentication with jwt inside a cookie with supertest, passport, and JEST


Hey guys I am currently am trying to do something similar to what is posted here: How to authenticate Supertest requests with Passport?

as I would like to test other endpoints that require authentication but in addition need to pass in a jwt. Right now, I tested it on POSTMAN and on the browser and it seems like it's working fine, but my test cases keep on breaking. I have a login POST route that is setup like so:

AccountService.js

// Login POST route
  router.post('/account_service/login', (req, res, next) => {
    passport.authenticate('local-login', (err, user, info) => {
      try {
        if (err) {
          const error = new Error('An Error occurred: Cannot find user');
          return next(error);
        } else if (!user) {
          return res.redirect('/account_service/login');
        }
        req.login(user, { session: false }, (error) => {
          if (error) {
            return next(error);
          }
          const email = req.body.email;
          const role = req.user[0].role;
          const id = req.user[0].id;

          const user = {
            email: email,
            role: role,
            id: id
          };
          const accessToken = jwt.sign(user, config.ACCESS_TOKEN_SECRET, {
            expiresIn: 28800 // expires in 8 hours
          });
          const cookie = req.cookies.cookieName;
          if (cookie === undefined) {
            // set a new cookie
            console.log('setting new cookie');
            res.cookie('jwt', accessToken, { maxAge: 900000, httpOnly: true });
            res.send({ token: accessToken });
          } else {
            // cookie was already present
            console.log('cookie exists', cookie);
          }
          res.redirect('/account_service/profile');
        });
      } catch (error) {
        return next(error);
      }
    })(req, res, next);
  });

After the user is authenticated, I assign a JSON web token to the user and place it in the cookie so it gets stored within the headers for authorized requests. Here is an example:

AccountService.js

// Get all users
  router.get('/account_service/all_users', passport.authenticate('jwt', { session: false }), (req, res, next) => {
    const sql = 'select * from user';
    const params = [];
    db.all(sql, params, (err, rows) => {
      if (err) {
        res.status(500).json({ error: err.message });
        return;
      }
      res.json({
        message: 'success',
        data: rows
      });
    });
  });

I use passport.authenticate to ensure that the jwt is valid. This GET request only works after I login with admin user account.

Within my passport file I have it setup like so:

passport.js

const LocalStrategy = require('passport-local').Strategy;
const db = require('../database.js');
const bcrypt = require('bcrypt');
const config = require('../config/config.js');
const JwtStrategy = require('passport-jwt').Strategy;

const cookieExtractor = function (req) {
  var token = null;
  if (req && req.cookies) token = req.cookies.jwt;
  return token;
};

module.exports = function (passport) {
  passport.serializeUser(function (user, done) {
    done(null, user);
  });
  passport.deserializeUser(function (user, done) {
    done(null, user);
  });
  passport.use('local-login', new LocalStrategy({
    usernameField: 'email',
    passwordField: 'password',
    passReqToCallback: true
  }, (req, email, password, done) => {
    try {
      const sql = `select * from user WHERE email = "${email}"`;
      const params = [];
      db.all(sql, params, (err, row) => {
        if (err) {
          return done(err);
        }
        if (!row.length || !bcrypt.compareSync(password, row[0].password)) {
          return done(null, false, req.flash('loginMessage', 'Inavalid username/password combination. Please try again.'));
        }
        return done(null, row);
      });
    } catch (error) {
      return done(error);
    }
  }));

  const opts = {};
  opts.jwtFromRequest = cookieExtractor; // check token in cookie
  opts.secretOrKey = config.ACCESS_TOKEN_SECRET;
  // eslint-disable-next-line camelcase
  passport.use(new JwtStrategy(opts, function (jwtPayload, done) {
    try {
      const sql = `select * from user WHERE email = "${jwtPayload.email}"`;
      const params = [];
      db.all(sql, params, (err, row) => {
        if (err) {
          return done(err);
        }
        if (!row.length || !bcrypt.compareSync('admin', jwtPayload.role)) {
          return done(null, false, { message: '403 Forbidden' });
        }
        return done(null, row);
      });
    } catch (error) {
      return done(error);
    }
  }));
};

Here's where I get confused as my test cases break. I am trying to login before my test cases to allow my other test cases to run but I end up getting a 401 error. Here are my test cases:

accountservice.test.js

const app = require('../../app');
const supertest = require('supertest');
const http = require('http');

describe('Account Service', () => {
  let server;
  let request;

  beforeAll((done) => {
    server = http.createServer(app);
    server.listen(done);
    request = supertest.agent(server);
    request.post('/account_service/login')
      .send({ email: '[email protected]', password: 'admin' })
      .end(function (err, res) {
        if (err) {
          return done(err);
        }
        console.log(res);
        done();
      });
  });

  afterAll((done) => {
    server.close(done);
  });

  it('Test request all users endpoint | GET request', async done => {
    const response = await request.get('/account_service/all_users');
    expect(response.status).toBe(200);
    expect(response.body.message).toBe('success');
    expect(response.body.data.length).toBe(3);
    done();
  });
});

But my test cases fail as I get a 401 error when it expects a 200 success code.

I tried thinking of a way to extract the jwt from a cookie after the login call so that I can set up the headers for the /account_service/all_users GET request code but was unable to find a way using Supertest. I saw this post: Testing authenticated routes with JWT fails using Mocha + supertest + passport but saw that it gets the token from the body.


Solution

  • After messing around with my code, I ended up having issues with in-memory storage and running asynchronous db.run functions that would call every time I ran my server. So I used a file to store my data and ran my tests again and it ended up working!

    Here was the faulty code:

    const sqlite3 = require('sqlite3').verbose();
    const md5 = require('md5');
    
    const DBSOURCE = ':memory:';
    
    const db = new sqlite3.Database(DBSOURCE, (err) => {
      if (err) {
        // Cannot open database
        console.error(err.message);
        throw err;
      } else {
        db.run(`CREATE TABLE user (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            name text, 
            email text UNIQUE, 
            password text, 
            status text,
            comments text, 
            photos text,
            CONSTRAINT email_unique UNIQUE (email)
            )`,
        (err) => {
          if (err) {
            // Table already created
            console.log('Table already created');
          } else {
            // Table just created, creating some rows
            const insert = 'INSERT INTO user (name, email, password, status, comments, photos) VALUES (?,?,?,?,?,?)';
            db.run(insert, ['user_delete', '[email protected]', md5('admin123456'), 'pending_deleted', 'comment1,comment2', 'https://giphy.com/gifs/9jumpin-wow-nice-well-done-xT77XWum9yH7zNkFW0']);
            db.run(insert, ['user_no_delete', '[email protected]', md5('user123456'), 'active', 'comment1', 'https://giphy.com/gifs/cartoon-we-bare-bears-wbb-NeijdlusjcduU']);
            db.run(insert, ['mikey', '[email protected]', md5('mikey123'), 'pending_deleted', 'comment1', 'https://giphy.com/gifs/wwe-shocked-vince-mcmahon-gdKAVlnm3bmKI']);
          }
        });
      }
    });
    
    module.exports = db;
    

    I simply stored this data within a file and used this code instead:

    const sqlite3 = require('sqlite3').verbose();
    const DBSOURCE = 'mockdb.sqlite';
    
    // Data inserted inside file
    /*
    db.run(insert, ['user_delete', '[email protected]', bcrypt.hashSync('admin123456', saltRounds), 'pending_deleted', 'comment1,comment2', 'https://giphy.com/gifs/9jumpin-wow-nice-well-done-xT77XWum9yH7zNkFW0', bcrypt.hashSync('user', saltRounds)]);
    db.run(insert, ['user_no_delete', '[email protected]', bcrypt.hashSync('user123456', saltRounds), 'active', 'comment1', 'https://giphy.com/gifs/cartoon-we-bare-bears-wbb-NeijdlusjcduU', bcrypt.hashSync('user', saltRounds)]);
    db.run(insert, ['mikey', '[email protected]', bcrypt.hashSync('mikey123', saltRounds), 'pending_deleted', 'comment1', 'https://giphy.com/gifs/wwe-shocked-vince-mcmahon-gdKAVlnm3bmKI', bcrypt.hashSync('user', saltRounds)]);
    db.run(insert, ['admin', '[email protected]', bcrypt.hashSync('admin', saltRounds), 'active', 'admincomments', 'adminphoto', bcrypt.hashSync('admin', saltRounds)]);
      console.log('last hit in database');
    });
    */
    
    const db = new sqlite3.Database(DBSOURCE, (err) => {
      if (err) {
        // Cannot open database
        console.error(err.message);
        throw err;
      }
      console.log('Connection successful!');
    });
    
    module.exports = db;
    
    

    I also ended up using supertest.agent.

    const app = require('../../app');
    const supertest = require('supertest');
    const http = require('http');
    const db = require('../../database/database.js');
    
    describe('Account Service', () => {
      let server;
      let request;
      // Find cookie management option.
      beforeAll(async (done) => {
        server = http.createServer(app);
        server.listen(done);
        request = supertest.agent(server);
        done();
      });
    

    And it ended up working and successfully solving my issue!