Document how to return newly authenticated to originally requested resource

[mkoistinen]

Greetings,

I've been trying to get passport to authenticate a user via Twitter, but return them to the protected resource that triggered the authentication request in the first place. I'm failing to make this work, sadly. It would be very useful if some of the documentation would make it clear how to achieve this. I'll even volunteer to update the documentation if someone could tell me how this is done.

Thanks.

[mkoistinen]

Greetings, I've figured this out. Basically, the approach is this:

Assuming you have defined the route for the callback from the authentication service like so (from the docs):

app.get('/auth/twitter/callback',
  passport.authenticate('twitter', {
      successRedirect: authenticationRedirect(req, '/account')
    , failureRedirect: '/'
  })
);

Just change that block to this:

app.get('/auth/twitter/callback', function(req, res, next){
  passport.authenticate('twitter', function(err, user, info){
    var redirectUrl = '/account'; // This is the default destination upon successful login.

    if (err) { return next(err); }
    if (!user) { return res.redirect('/'); }

    // If we have previously stored a redirectUrl, use that, otherwise, use the default.
    if (req.session.redirectUrl) {
      redirectUrl = req.session.redirectUrl;
      req.session.redirectUrl = null;
    }
    req.logIn(user, function(err){
      if (err) { return next(err); }
    });
    res.redirect(redirectUrl);
  })(req, res, next);
});

Now, define your middleware for authenticated routes to store the original URL in the session like this:

ensureAuthenticated = function (req, res, next) {
  if (req.isAuthenticated()) { return next(); }

  // If the user is not authenticated, then we will start the authentication
  // process.  Before we do, let's store this originally requested URL in the
  // session so we know where to return the user later.

  req.session.redirectUrl = req.url;

  // Resume normal authentication...

  logger.info('User is not authenticated.');
  req.flash("warn", "You must be logged-in to do that.");
  res.redirect('/');
}

Works!