0

My server is authenticating API requests using a token sent as a header. All the requests are mandatorily passed through that authentication check.

Now, I want to get a token using OAuth 2.0 to hit some third party APIs, so I am passing all the credentials to their OAuth service including the redirect URI. But the thing is I am not able to authenticate the user when the third party service redirects to the provided URI because it lacks that authentication header.

Here is what could have helped- How to pass headers while doing res.redirect in express js but unfortunately, Node.js doesn't support setting headers while redirecting.

I can't see any way to alter the middleware without affecting other APIs because had this been possible, I would have simply maintained user session for that. Even if I add that check of session, I can't disable the header check so the session thing seems futile to me now.

Now, I think the only option I am left with is trying to set headers to the redirect request. This question is about the same thing- Redirect to OAuth URL with headers but it is about creating a custom response object for the OAuth in Python. I don't think my third party OAuth service would allow that.

The last thing that I have thought of is somehow passing the token into the state query and getting the same back for authorization into header somehow.

This is the request for authorization:

function getToken() {
    //some checks here
    res.redirect(BASE_THIRD_PARTY_URL + CREDENTIAL_QUERIES + REDIRECT_URI + "state="+TOKEN)
}

(Plus passing token in state query in URL seems security threat somehow)

So, is it possible to set headers (or some other workaround)?

Kashish Arora
  • 860
  • 5
  • 25
  • 39

0 Answers0