laardee / serverless-authentication-boilerplate

Generic authentication boilerplate for Serverless framework
http://laardee.github.io/serverless-authentication-gh-pages
MIT License
568 stars 71 forks source link

Callback request to authorization_uri ends up using http protocol with port 443 #62

Closed Denerot closed 6 years ago

Denerot commented 6 years ago

Hello, I'm having a problem where, even though my authorization_uri is set to an https address, when it ends up making the request, it formats the url like so: http://foo.bar.com:443/v1/token/jwt

Our endpoint ends up returning a moved permanently 301 because it does not start with https. Here's the set up I have in my custom provider (some values changed for privacy):

const callbackHandler = (event, config, callback) => {
  const myProvider = new Provider(config);
  const profileMap = response =>
    new Profile({
      id: response.id,
      provider: 'foo-sso',
      at: response.access_token
    });

  const options = {
    authorization_uri: 'https://foo.bar.com/v1/token/jwt',
    profile_uri: 'https://foo.bar.com/api/me',
    profileMap
  };

  myProvider.callback(
    event,
    options,
    { authorization: { grant_type: 'authorization_code' } },
    callback
  );
};

When I print out the response object from your serverless-authentication -> provider.js line 102 notice that the location of the response is http://foo.bar.com:443/v1/token/jwt/

location: 'http://foo.bar.com:443/v1/token/jwt/',
'content-length': '253',
connection: 'close',
'content-type': 'text/html; charset=iso-8859-1' } },
read: [Function],
body: '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\n<html><head>\n<title>301 Moved Permanently</title>\n</head><body>\n<h1>Moved Permanently</h1>\n<p>The document has moved <a href="http://foo.bar.com:443/v1/token/jwt/">here</a>.</p>\n</body></html>\n' }

Do you have any idea of what might be happening here? I've dug into the request module and found some places where it established protocol and everything seems fine, I can't quite find where the post function is defined that is called in provider.js on line 101. If you could even help me find the definition of that post function that would help me greatly, so I can figure out when my authorization_uri gets changed to http protocol.

_request2.default.post(authorization_uri, { form: payload }, function (error, response, accessData) {