Enable session middleware by default (fixes U&P provider authentication) #11825

petersg83 · 2021-12-06T15:46:46Z

It enables session middleware by default (which fixes U&P provider authentication)
It removes the possibility to authenticate requests using access_token url query param
It fixes a wording where the displayed provider name was wrong

Based on a previous PR created by @rgoupil #11777

also fix #7405 (thank you @borm for showing a fix)

codecov · 2021-12-06T15:55:13Z

Codecov Report

Merging #11825 (56407e8) into master (644624d) will increase coverage by 0.07%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master   #11825      +/-   ##
==========================================
+ Coverage   47.68%   47.75%   +0.07%     
==========================================
  Files         212      210       -2     
  Lines        8223     8139      -84     
  Branches     1863     1835      -28     
==========================================
- Hits         3921     3887      -34     
+ Misses       3547     3503      -44     
+ Partials      755      749       -6

Flag	Coverage Δ
front	`?`
unit	`47.75% <100.00%> (+0.07%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
packages/core/admin/server/strategies/api-token.js	`100.00% <ø> (+3.03%)`	⬆️
packages/core/strapi/lib/services/fs.js	`71.42% <100.00%> (ø)`
packages/core/strapi/lib/core/registries/config.js

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 644624d...56407e8. Read the comment docs.

packages/plugins/users-permissions/server/routes/content-api/auth.js

packages/core/strapi/lib/Strapi.js

packages/core/strapi/lib/middlewares/session.js

packages/plugins/users-permissions/server/routes/content-api/auth.js

examples/getstarted/config/middlewares.js

packages/core/strapi/lib/middlewares/session.js

derrickmehaffy · 2021-12-20T16:04:09Z

Will test it after the monday meeting @petersg83 👍

packages/core/strapi/lib/middlewares/session.js

packages/plugins/users-permissions/server/bootstrap/index.js

packages/core/strapi/lib/middlewares/session.js

packages/core/strapi/lib/services/server/middleware.js

packages/plugins/users-permissions/server/controllers/auth.js

alexandrebodin

I don't understand why we need all the env_path manipulations for the tests. If we use the generator we should just have a valid .env in the testApp 🤔

Also I would keep the .env.example as when the dev will push their app they won't get a .env we should generate one with the missing env vars

examples/getstarted/config/middlewares.js

petersg83 · 2022-01-19T16:03:06Z

env_path : The .env is not detected because the script run is not located next to the .env file, so we need to specify the correct path. Before that the .env file of the testApp was full of generated token (each time the app was restarted they were generated again). Do you think we can do something simpler?

…_token

… .env

test/e2e.js

alexandrebodin · 2022-01-25T09:32:58Z

packages/generators/app/lib/resources/files/config/server.js

@@ -1,4 +1,7 @@
 module.exports = ({ env }) => ({
  host: env('HOST', '0.0.0.0'),
  port: env.int('PORT', 1337),
+  app: {
+    keys: env.array('APP_SECRETS'),


shouldn't we call that APP_KEYS ?

Yes let's do that

alexandrebodin

LGTM. It's a lot cleaner than previously

strapi-bot · 2022-03-16T17:19:13Z

This pull request has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/user-authentication-with-next-js-and-strapi/6289/19

petersg83 requested review from Elhebert, mfrachet, alexandrebodin, HichamELBSI, soupette, Convly and ronronscelestes December 6, 2021 15:46

This was referenced Dec 6, 2021

Fix session middleware not migrated with v4 #11777

Closed

[V4] Auth Providers issues #11337

Closed

derrickmehaffy requested changes Dec 7, 2021

View reviewed changes

rgoupil reviewed Dec 7, 2021

View reviewed changes

packages/core/strapi/lib/Strapi.js Show resolved Hide resolved

packages/core/strapi/lib/middlewares/session.js Outdated Show resolved Hide resolved

alexandrebodin requested changes Dec 9, 2021

View reviewed changes

packages/plugins/users-permissions/server/routes/content-api/auth.js Outdated Show resolved Hide resolved

examples/getstarted/config/middlewares.js Outdated Show resolved Hide resolved

packages/core/strapi/lib/middlewares/session.js Show resolved Hide resolved

petersg83 force-pushed the fix/enable-session-middleware branch from 168a33f to e0a9228 Compare December 20, 2021 15:51

petersg83 changed the title ~~Enable session middleware by default + make auth U&P routes public + fix provider name~~ Enable session middleware by default + remove access_token url auth + fix provider name Dec 20, 2021

petersg83 requested review from alexandrebodin and derrickmehaffy December 20, 2021 15:55

petersg83 added this to the 4.0.1 milestone Dec 20, 2021

petersg83 added issue: bug Issue reporting a bug source: plugin:users-permissions Source is plugin/users-permissions package labels Dec 20, 2021

petersg83 changed the title ~~Enable session middleware by default + remove access_token url auth + fix provider name~~ Enable session middleware by default Dec 20, 2021

petersg83 changed the title ~~Enable session middleware by default~~ Enable session middleware by default (fixes U&P provider authentication) Dec 20, 2021

alexandrebodin requested changes Dec 20, 2021

View reviewed changes

alexandrebodin reviewed Dec 20, 2021

View reviewed changes

packages/core/strapi/lib/middlewares/session.js Outdated Show resolved Hide resolved

hdeadman reviewed Dec 21, 2021

View reviewed changes

packages/core/strapi/lib/services/server/middleware.js Show resolved Hide resolved

petersg83 mentioned this pull request Dec 21, 2021

Plugin users-permissions providers Custom callback url doesn't work #7405

Closed

alexandrebodin reviewed Dec 22, 2021

View reviewed changes

packages/plugins/users-permissions/server/controllers/auth.js Show resolved Hide resolved

alexandrebodin modified the milestones: 4.0.1, 4.0.2 Dec 22, 2021

alexandrebodin requested changes Jan 19, 2022

View reviewed changes

examples/getstarted/config/middlewares.js Outdated Show resolved Hide resolved

petersg83 added 6 commits January 19, 2022 17:10

add session middleware + remove authentication using url param access…

da9b064

…_token

use strapi.log.info + replace uuid by crypto + remove dead code

c4fee8e

fix typo

5cdd3f0

fix dynamic callback

e230827

create app keys at app creation instead of runtime auto-generation

8b39d44

add session middleware to new project config + fix test app not using…

1dc74b0

… .env

petersg83 force-pushed the fix/enable-session-middleware branch from 1427fb7 to 1dc74b0 Compare January 19, 2022 16:13

add env.example back + code style

3facd1d

petersg83 requested a review from alexandrebodin January 19, 2022 16:22

alexandrebodin modified the milestones: 4.0.5, 4.0.6 Jan 19, 2022

fix appendFile

597df20

alexandrebodin reviewed Jan 21, 2022

View reviewed changes

test/e2e.js Outdated Show resolved Hide resolved

petersg83 and others added 4 commits January 21, 2022 14:01

Merge branch 'master' into fix/enable-session-middleware

4d51e81

remove log

2b069be

remove url config

c9b0f04

Merge branch 'master' into fix/enable-session-middleware

e58b726

petersg83 requested a review from alexandrebodin January 24, 2022 10:36

petersg83 and others added 2 commits January 24, 2022 17:01

better handle env variables in e2e tests

83d321a

Merge branch 'master' into fix/enable-session-middleware

46a4dd0

alexandrebodin reviewed Jan 25, 2022

View reviewed changes

petersg83 and others added 2 commits January 25, 2022 11:06

rename APP_SECRETS to APP_KEYS

b48cf11

Merge branch 'master' into fix/enable-session-middleware

56407e8

alexandrebodin approved these changes Jan 25, 2022

View reviewed changes

alexandrebodin merged commit d796cf9 into master Jan 25, 2022

alexandrebodin deleted the fix/enable-session-middleware branch January 25, 2022 12:24

derrickmehaffy mentioned this pull request Jan 28, 2022

Add v4.0.6 migration guide strapi/documentation#691

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable session middleware by default (fixes U&P provider authentication) #11825

Enable session middleware by default (fixes U&P provider authentication) #11825

petersg83 commented Dec 6, 2021 •

edited

codecov bot commented Dec 6, 2021 •

edited

derrickmehaffy commented Dec 20, 2021

alexandrebodin left a comment

petersg83 commented Jan 19, 2022

alexandrebodin Jan 25, 2022

petersg83 Jan 25, 2022

alexandrebodin left a comment •

edited

strapi-bot commented Mar 16, 2022

Enable session middleware by default (fixes U&P provider authentication) #11825

Enable session middleware by default (fixes U&P provider authentication) #11825

Conversation

petersg83 commented Dec 6, 2021 • edited

codecov bot commented Dec 6, 2021 • edited

Codecov Report

derrickmehaffy commented Dec 20, 2021

alexandrebodin left a comment

Choose a reason for hiding this comment

petersg83 commented Jan 19, 2022

alexandrebodin Jan 25, 2022

Choose a reason for hiding this comment

petersg83 Jan 25, 2022

Choose a reason for hiding this comment

alexandrebodin left a comment • edited

Choose a reason for hiding this comment

strapi-bot commented Mar 16, 2022

petersg83 commented Dec 6, 2021 •

edited

codecov bot commented Dec 6, 2021 •

edited

alexandrebodin left a comment •

edited