@@ -41,6 +41,12 @@ app.use(bodyParser.json()); //parses bodies of media type "application/json"
app.use(bodyParser.urlencoded({//parses bodies of media type "application/x-www-form-urlencoded"
extended:true//use qs library (quoi que ca veuille dire o.O)
}));
app.use(cookieParser());//parses Cookie header and populate req.cookies with an object keyed by the cookie names. was necessary for express-session before its v1.5.0. on peut probablement l'enlever desormais.
//GHETTO
// Config de passport pour l'authentification ldap.
// Ne fait que *configurer* passport pour la strategie 'ldap' (pas d'incidence sur la strategie 'session' normalement)
// WTF??? why is sessionSecret in ldap_config.json? it has nothing to do with ldap. TODO
//app.use(cookieParser()); //parses Cookie header and populate req.cookies with an object keyed by the cookie names. was necessary for express-session before its v1.5.0. on peut probablement l'enlever desormais.
// defines parameters for *session store*. (adds field req.session and do some magic stuff)
// basically, searches for a session matching the received cookie and, if found, adds field req.blasomethingbla containing serialized object representing user (i.e. similar to what passport.serializeUser() could produce)
// TODO: it is important to configure this right!!! please check out https://www.npmjs.com/package/express-session and make sure you understand the way session is stored. (en vrai c'est vraiment important...)
...
...
@@ -86,9 +90,23 @@ app.use(session({
//store: // TODO: change this. express-session doc warns that default value is ok to use for development only
}));
app.use(passport.initialize());//initialize Passport. (adds hidden field req._passport and do some magic stuff)
app.use(passport.session());//this is equivalent to app.use(passport.authenticate('session'))
//GHETTO
//app.use(passport.session()); //this is equivalent to app.use(passport.authenticate('session'))
app.use(passport.session(),(req,res,next)=>{
console.log("Used passport.session()");
console.log(`passport.session() found user: ${req.user?req.user.uid:"none"}`);
console.log("passport.session() user is authenticated:",req.isAuthenticated());
next();
});//this is equivalent to app.use(passport.authenticate('session'))
// *aucun* effet sur les requetes n'ayant pas ete reconnues par app.use(session(...)) (e.g. les requetes sans cookie ou les requetes avec cookie expired). source: lecture directe du code passport/lib/strategies/session.js sur github... :/
/*
app.use((req, res, next) => {
console.log("Finished trying to authentify request as an existing session");
console.log("req.user: "+req.user);
});
*/
/**
* FIN AUTHENTIFICATION POUR LES REQUETES POSSEDANT UN COOKIE ET PROVENANT D'UN UTILISATEUR DEJA AUTHENTIFIE
*/
...
...
@@ -114,7 +132,8 @@ const corsOptions = {
credentials:true// Configures the Access-Control-Allow-Credentials CORS header. i.e. allows cookies to be included on cross-origin requests
};
app.use(cors(corsOptions));
//GHETTO
// Config de passport pour l'authentification ldap. Ne fait que *configurer* passport (aucun passport.authenticate() n'est appele, par exemple)
// return next(err); // handle error? or drop request and answer with res.json()?
}
// If all went well
res.json({
console.log("| Authentication succeeded! :-)");
// passport.authenticate automatically includes a Set-Cookie HTTP header in the response. The JSON body is just to signal the frontend that all went well
returnres.status(200).json({
message:'Authentication succeeded',
authSucceeded:true
});
...
...
@@ -192,17 +218,17 @@ app.post('/login',
import{dn,passwd}from"../ldap_connexion_config.json";// default user
app.use('/graphql',
bodyParser.json(),// parse incoming HTTP request (req) as a JSON
