johnbrett / hapi-auth-bearer-token

Simple Bearer authentication scheme plugin for hapi, accepts token by Header, Cookie or Query parameter.
MIT License
218 stars 46 forks source link

Exception when allowChaining is true and the strategies are defined via default auth value #171

Closed ssanchezmarc closed 5 years ago

ssanchezmarc commented 5 years ago

In our use case, we are trying to define two auth strategies to be validated one before other. Defining hapi-auth-bearer-token validation as the first one, we have seen that it is possible using the flag allowChaining. If the bearer token received in not a valid token, try the second one before saying that the token is not valid.

server.auth.strategy('simple', 'bearer-access-token', { allowChaining: true, validateFunc });
server.auth.strategy('jwt', 'jwt', jwtValidation);

It we define the strategies in each route, it works as we expected:

{
      method: 'GET',
      options: {
        auth: {
          strategies: ['simple', 'jwt'],
        },
     }
}

But if we try to define the strategies as the default ones, we face an exception:

server.auth.default({ strategies: ['simple', 'jwt'] });

The exception comes from the following line of the scheme definition:

const message = (settings.allowChaining && request.route.settings.auth.strategies.length > 1) ? null : 'Bad token';

strategies is undefined.

Could we add support for default option when we define multiple strategies ?

johnbrett commented 5 years ago

@ssanchezmarc this should be resolved in the latest release: https://github.com/johnbrett/hapi-auth-bearer-token/blob/master/lib/index.js#L85

can you verify it's still an issue? I'm going to close this, but please feel free to re-open if it's a problem. Thanks for opening this issue and apologies for the delay in getting back to you.