koa-passport icon indicating copy to clipboard operation
koa-passport copied to clipboard

mocking request loses original koa app instance, breaking resolving of req.subdomains, because req.app.subdomainOffset is undefined

Open falkenhawk opened this issue 5 years ago • 4 comments

request.subdomains getter depends on request.app.subdomainOffset, which can be configured after koa is instantiated:

  • https://koajs.com/#settings

e.g. for hostname app.example.com original ctx.subdomains would resolve to ['app'] (with koa's default subdomainOffset = 2), and mocked req.subdomains would resolve to ['com', 'example', 'app'].

(This is breaking passport authentication for us because we are resolving tenants from subdomains, and at the same time we are checking jwt's issuer if it matches the subdomain)

Of course I can workaround it, but nevertheless I'd consider it as a bug. What's interesting, koa-passport initially delegated original app object in req.app but then, probably with this change: https://github.com/rkusa/koa-passport/commit/0b7da657d31ec5910b558252b4351316bc67f28a it began to overwrite app with that almost-empty mock, which can only return trust proxy property and nothing besides that.

falkenhawk avatar Apr 19 '19 16:04 falkenhawk

Sorry for the late reply. What is your feeling, what the best solution would be? Extend the app mock to support your (totally valid!) use-case. Or replace the app mock with the original app, but monkey patch the original app to support express' trust proxy setting (thanks for already pointing out the commit where this change has been introduced)?

rkusa avatar Jun 03 '19 08:06 rkusa

With the latest version of koa (2.11) it also breaks req.ip because it depends on req.app.proxyIpHeader and app is mocked into an almost empty object. I guess the second approach you've suggested would be the correct one, that's the most logical thing to do in my opinion.

netherspite avatar Jan 10 '20 07:01 netherspite

Just had this problem when using req.ip in my strategy.
Any news about this one ?

mrrinot avatar Sep 28 '20 13:09 mrrinot

Any update?

Manjiz avatar Nov 25 '20 11:11 Manjiz