All geek questions in one place

Does pass.js have session convergence when deployed to multiple instances of node.js

Does pass.js require session convergence when deployed across multiple instances of Node.js? When I use session affinity, authentication works correctly with multiple instances (with load balancing). I use redis as a session repository. However, if you do not use a similar session, the .js passport fails with the error below. With one instance, it always works. Is there a way to make pass.js work without an affinity session.

500 Failed to verify assertion (message: Invalid association handle) at Strategy.authenticate.identifier (node_modules/passport-google/node_modules/passport-openid/lib/passport-openid/strategy.js:184:36) at _verifyAssertionData (node_modules/passport-google/node_modules/passport-openid/node_modules/openid/openid.js:1053:12) at _verifyAssertionAgainstProvider (node_modules/passport-google/node_modules/passport-openid/node_modules/openid/openid.js:1178:14) at _checkSignatureUsingAssociation (node_modules/passport-google/node_modules/passport-openid/node_modules/openid/openid.js:1229:14) at Object.openid.loadAssociation (node_modules/passport-google/node_modules/passport-openid/node_modules/openid/openid.js:111:5) at _checkSignatureUsingAssociation (node_modules/passport-google/node_modules/passport-openid/node_modules/openid/openid.js:1221:10) at _checkSignature (node_modules/passport-google/node_modules/passport-openid/node_modules/openid/openid.js:1211:5) at _verifyAssertionAgainstProvider (node_modules/passport-google/node_modules/passport-openid/node_modules/openid/openid.js:1174:3) at _verifyDiscoveredInformation node_modules/passport-google/node_modules/passport-openid/node_modules/openid/openid.js:1145:16) at openid.discover (node_modules/passport-google/node_modules/passport-openid/node_modules/openid/openid.js:668:7)

Snapshots of code using a passport:

 app.set('port', process.env.PORT || 8080); app.set('views', __dirname + '/views'); app.set('view engine', 'ejs'); app.use(express.favicon()); app.use(express.logger('dev')); app.use(express.query()); app.use(express.bodyParser()); app.use(express.methodOverride()); app.use(express.cookieParser()); app.use(express.session({ key: 'JSESSIONID', secret: '****', cookie : {httpOnly:false, maxAge: 5*60*1000, path: '/'}, store: new RedisStore({ prefix: 'sid:', client: redisClient }) })); app.use(passport.initialize()); app.use(passport.session()); app.use(app.router); app.use(express.static(path.join(__dirname, 'public'))); app.get('/auth/google', passport.authenticate('google')); app.get('/auth/google/return', passport.authenticate('google', { successRedirect: '/success', failureRedirect: '/login' }));

I also have serializeUser and deserializeUser which uses redis store to store / retrieve the user object, but this error occurs when the identity provider redirects back to the callback URI. I deploy my application to AppFog and establish session affinity with the JSESSIONID cookie key (which works with cloud-based balancers). If I use any other key (this means that the affinity of the session is disabled), then the error is caused by the passport. Js.

+6
source share
1 answer

I think I fixed it. There is an option: "stateless", which can be transferred to GoogleStrategy. I understood this by looking at the source: https://github.com/jaredhanson/passport-openid/blob/master/lib/passport-openid/strategy.js . Therefore, the GoogleStrategy instance must be:

 new GoogleStrategy({ returnURL: BASE + '/auth/google/return', realm: BASE + "/", stateless: true }

Thanks to Jared Hanson for implementing this option! (I hope it will be documented on the main site).

+7
source

Source: https://habr.com/ru/post/947985/

More articles:


All Articles