We Keep Coding

use http-proxy inside a express JS server

I have get a login page code on the web based on express nodeJS.
I have many backend app running on different port. The goal is, when a user is authentificated in the nodeJS server, he's automaticaly redirected to his app.
But, if i can mount a http-proxy separated and run it properly, i would want to include proxying in this loggin JS code when user is connected.
There is the part of the code below.
const httpProxy = require('http-proxy');
const proxy = httpProxy.createProxyServer();
(...)
// http://localhost:3000/auth
app.post('/auth', function(request, response) {
// Capture the input fields
let username = request.body.username;
let password = request.body.password;
// Ensure the input fields exists and are not empty
if (username && password) {
// Execute SQL query that'll select the account from the database based on the specified username and password
connection.query('SELECT * FROM accounts WHERE username = ? AND password = ?', [username, password], function(error, results, fields) {
// If there is an issue with the query, output the error
if (error) throw error;
// If the account exists
if (results.length > 0) {
// Authenticate the user
request.session.loggedin = true;
request.session.username = username;
// Redirect to home page
proxy.web(req, res, { target: 'http://127.0.0.1:1881' });
//response.redirect('/home');
} else {
response.send('Incorrect Username and/or Password!');
}
response.end();
});
} else {
response.send('Please enter Username and Password!');
response.end();
}
});
app.listen(3000);
At the response.redirect('/home');i want to replace it by proxying, but nothing append.
I don't know if this is possible, because running 2 servers on the same instance.
Thank you for your help.
Regard

I think it is better to use this package if you use express: https://www.npmjs.com/package/express-http-proxy
You can use it like this:
const { createProxyMiddleware, fixRequestBody, responseInterceptor } = require( 'http-proxy-middleware' );
const proxyMiddleware = createProxyMiddleware({
target: 'foo',
onProxyReq: fixRequestBody,
logLevel: 'debug',
changeOrigin: true,
secure: false,
xfwd: true,
ws: true,
hostRewrite: true,
cookieDomainRewrite: true,
headers: {
"Connection": "keep-alive",
"Content-Type": "text/xml;charset=UTF-8",
"Accept": "*/*"
},
});
app.use( '/youRoute/**', proxyMiddleware );
And then when you are loged in you redirect to you you proxified route :
res.redirect('/youRoute/');

Cannot read property 'session' of undefined - Manage Session Cookie Firebase Auth generated cookie

The problem that I am facing is that after setting a Firebase session cookie, I go to another endpoint that needs to be secure, but req cannot find the cookie.
I am following a Firebase tutorial called Manage Session Cookies that describes how to generate a cookie after a user has logged in using the Firebase signInWithEmailAndPassword function. The user idToken is then passed over to a POST request:
First, I am generating a token and sending it to an endpoint:
function signIn() {
var email = document.getElementById('email').value;
var password = document.getElementById('password').value;
firebase.auth().signInWithEmailAndPassword(email, password).catch(function(error) {
var errorCode = error.code;
var errorMessage = error.message;
if (errorCode === 'auth/wrong-password') {
alert('Wrong password.');
} else {
alert(errorMessage);
}
document.getElementById('quickstart-sign-in').disabled = false;
}).then(user => {
// Get the user's ID token as it is needed to exchange for a session cookie.
return user.getIdToken().then(idToken => {
if (firebase.auth().currentUser) {
$.ajax({
method: 'POST',
url: '/login',
data: {'email':firebase.auth().currentUser.email,idToken},
success: function(data) {
//do other things...
}
});
}
});
})
}
The URL endpoint, which is getting the idToken from the prior POST request, creating a session cookie with createSessionCookie, then setting the cookie using res.cookie('session', sessionCookie, options):
exports.postLogin = (req, res, next) => {
// Get the ID token passed
const idToken = req.body.idToken.toString();
// Set session expiration to 14 days.
const expiresIn = 60 * 60 * 24 * 14 * 1000;
var exampleDB = admin.database().ref('exampleDB');
exampleDB.once('value', function(snapshot) {
//unrelated things happening...
//generate randomData...
}).then(function() {
admin.auth().createSessionCookie(idToken, {expiresIn})
.then((sessionCookie) => {
// Set cookie policy for session cookie.
const options = {maxAge: expiresIn, httpOnly: true, secure: true};
res.cookie('session', sessionCookie, options);
res.status(200).send(randomData).end();
}, error => {
res.status(401).send('UNAUTHORIZED REQUEST!');
});
});
};
The problem that I am facing starts here, when I go to another endpoint, /dashboard. The cookie that I had supposedly set cannot be found, and instead I get an error message stating TypeError: Cannot read property 'session' of undefined for my session cookie:
exports.dashboard = (req, res, next) => {
const sessionCookie = req.cookies.session || '';
// a bunch of other code around the session cookie that doesn't even get triggered because of the break in req.cookies.session
}
Am I retrieving the cookie incorrectly? Or have I not set the cookie properly? Or is the cookie somehow not being carried over to this new endpoint, /dashboard, from the page on which the POST to /login happens?
After logging the req to /dashboard I see that I have the following in there, but I don't know if it's from another session for something. If it is from Firebase, I don't know how to access it correctly:
sessionID: 'ublahxARQVljyGRblahPQrei',
session:
Session {
cookie:
{ path: '/',
_expires: null,
originalMaxAge: null,
httpOnly: true },
returnTo: '/dashboard',
flash: {},
_csrfSecret: 'r46blahE+kOzblah5==' },

I believe that you need to use the __session cookie.
When using Firebase Hosting together with Cloud Functions or Cloud
Run, cookies are generally stripped from incoming requests.
source
This has been encountered before in a different form: Firebase Functions : How to store simple cookies to remember an authenticated user

How to include credentials in node request?

im trying to get array edges from this url
`https://www.instagram.com/graphql/query/?query_id=17851374694183129&variables={"id":"500818047","first":10}
In the frontend, I can get this array with fetch and credentials: 'include'.
But I can't work with him because of CORS. So, I try to do this in app.js using node, but array is still hidden.
That's what I get:
{
edge_followed_by:
{
count: 18213,
page_info: { has_next_page: false, end_cursor: null },
edges: []
}
}
How to enable the parameter credentials in node request? Or, if I do something wrong, how to get this array?
var cors = require('cors');
app.use(cors());
var request = require("request");
const url = 'https://www.instagram.com/graphql/query/?query_id=17851374694183129&variables={"id":"500818047","first":10}';
request({
url: url,
json: true,
}, function (error, response, body) {
if (!error && response.statusCode === 200) {
console.log(body['data']['user'])
}
});

This is because when you hit the URL from frontend you may have already logged into Instagram so the User Access Token is present in your browser's cookies and hence you are able to access all the information in edges
Try the same thing after logging out of Instagram or try it with incognito mode and you would find that edges are empty because the browser no longer holds the User Access Token needed to check for permissions and provide you with the information.
To do it from a backend service follow the steps provided here,
https://developers.facebook.com/docs/instagram-api/getting-started
Hope this helps. :)

Have you taken a look at the request docs?
You have the following options to authenticate your request:
request.get('http://some.server.com/').auth('username', 'password', false);
// or
request.get('http://some.server.com/', {
'auth': {
'user': 'username',
'pass': 'password',
'sendImmediately': false
}
});
// or
request.get('http://some.server.com/').auth(null, null, true, 'bearerToken');
// or
request.get('http://some.server.com/', {
'auth': {
'bearer': 'bearerToken'
}
});

How to use JWT in Client with AJAX

My application is a Node.js API with a client inside the same application.
I'm trying to implement a simple auth login that uses a JWT token generated by a Node.js API.
My logic is as follows:
Client: User submits login information to /auth/login route.
$.ajax({
url: "/auth/login",
type: "POST",
data: formData,
dataType: "json",
success: function(data, textStatus, jqXHR) {
if (typeof data.redirect == "string") {
window.location = data.redirect;
}
},
error: function(data) {
if (typeof fail === "function") fail(data);
}
});
API: Verify user and on success generates JWT and sends back to the client.
router.post("/login", async (req, res) => {
var login = { UID: req.body.UID, password: req.body.password };
AU.manualLogin(login)
.then(result => {
res.header("x-auth-token", result.token).json({
status: 200,
message: "success",
data: result.data,
redirect: "/dashboard"
});
})
.catch(err => next({ status: 400, message: err.message }));
});
Client: Saves JWT to the header and checks for redirect - In this case, I use window.location to direct to /dashboard after successful login. (this part I'm not sure about)
API: Middleware checks valid JWT on protected routes.
module.exports = function auth(req, res, next) {
const token = req.headers["x-auth-token"];
if (!token)
return res.status(401).send("Access denied. No token provided.");
try {
const decoded = jwt.verify(token, "jwtPrivateKey");
req.user = decoded;
next(); //pass control to next middleware
} catch (ex) {
res.status(400).send("Invalid token.");
}
};
The Problem:
The token is definitely being sent from API -> Client. But I have no idea how to handle the token from the client-side. I think the issue might be to do with the window.location redirect as at this point it does not seem to be sending the x-auth-token to the API.
What I have tried
I have tested the solution with Postman from end-to-end and it works fine. That probably proves that it isn't the API side that has the issue.
I've also tried these sources:
Pass request headers in a jQuery AJAX GET call
Adding custom header in HTTP before redirect
How to add header to request in Jquery Ajax?
jwt on node - how does the client pass the token back to the server

You need kind of a storage to keep the token. Otherwise the user has always to login again after he closes the browser/tab. So it's quite common to keep the token in local or session storage.
Approach 1: Use a single page application (SPA) framework like angular, vue.js, react etc. to protect your routes client-side
Approach 2: You can request only html and css (view) from your backend and then store the token after a login procedure. With a valid token, fetch the (protected) data with ajax requests. Redirect to the login page if a ajax request returns the status code 401 (unauthorized) or a user wants to access the protected route without having a token stored. This is perhaps the most suitable for you.
Approach 3: Use Node.js with a backend framework like express and store auth information in a server side session
index.js
const express = require('express');
const session = require('express-session');
const app = express();
app.use(require("cookie-parser")());
app.use(session({ secret: 'aslwezoweasdfasdlkfalksdfhweelaerfcv', resave: false, saveUninitialized: true}));
routes/protectedRoutes.js
const express = require('express');
const router = express.Router();
router.all("/*", util.handleAuthenticate); // check auth on every request
// other routes
indexController.js (login functionality)
module.exports.login = function(req, res) {
if(!req.session.name) {
// check username/password --> db lookup
// if valid:
req.session.name = ...
// redirect to home or backref
// else: redirect to login
}
}
util/security.js
function isLoggedIn(req) {
return !!req.session.name;
}
function handleAuthenticate(req, res, next) {
if(isLoggedIn(req))
{
next();
}
else
{
// redirect to login page
}
}

How do you handle cookies with request-promise?

I'm having trouble scraping a website that needs authentication, and is using session cookies. The session requires a request with POST, and the authentication then approves. But when I want to GET the webpage that need authentication, it returns "Unauthorized". I guess I need a way to bring the session cookie with the GET-request, but I don't know how! My dependencies is request-promise(https://www.npmjs.com/package/request-promise).
The code looks like this:
var rp = require("request-promise");
var options = {
method: "POST",
uri: "http://website.com/login",
form: {
username: "user",
password: "pass",
},
headers: {},
simple: false
};
rp(options).then(function(response) {
console.log(response); // --> "Redirecting to login/AuthPage"
request("http://website.com/login/AuthPage", function(err, res, body) {
console.log(body); // --> "Unauthorized"
})
}).catch(function(e) {
console.log(e)
})
I'm guessing you have to put the request in a "Jar" (https://github.com/request/request#requestjar), to be able to reach the next request-URL, but how can I set the request-promise to create a cookie-jar?

Your problem is how to keep the session after authentication.
That means, after logging in by using username and password, the server will return a cookie with an identifier. Then you need to attach that cookie to all your feature requests.
It's simple with request-promise. Just keep tracking session by enabling jar option then use the same request object for all requests.
Let take a look
var request = require("request-promise").defaults({ jar: true });
var options = {
method: "POST",
uri: "http://website.com/login",
form: {
username: "user",
password: "pass",
},
headers: {},
simple: false
};
request(options).then(function(response) {
request("http://website.com/login/AuthPage", function(err, res, body) {
console.log(body);
})
}).catch(function(e) {
console.log(e)
})

Use the following object while making rest calls.
var request = require("request-promise").defaults({jar: true});
To add your own cookies
var tough = require('tough-cookie');
// Easy creation of the cookie - see tough-cookie docs for details
let cookie = new tough.Cookie({
key: "some_key",
value: "some_value",
domain: 'api.mydomain.com',
httpOnly: true,
maxAge: 31536000
});
// Put cookie in an jar which can be used across multiple requests
var cookiejar = rp.jar();
cookiejar.setCookie(cookie, 'https://api.mydomain.com');
// ...all requests to https://api.mydomain.com will include the cookie
var options = {
uri: 'https://api.mydomain.com/...',
jar: cookiejar // Tells rp to include cookies in jar that match uri
};
and then make the call. More details about request-promise:
https://www.npmjs.com/package/request-promise