panva / openid-client

OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
MIT License
1.83k stars 392 forks source link

client.callbackParams throws an error when IncomingMessage is passed as argument #698

Closed marko1010 closed 1 week ago

marko1010 commented 1 week ago

Describe the bug

The client.callbackParams function accepts the input parameter types: string | http.IncomingMessage | http2.Http2ServerRequest.

When an argument of type http.IncomingMessage is passed to this function, it throws the following error: 'incoming message body missing, include a body parser prior to this method call'.

To Reproduce

    fastify.post('/callback', async function (req: FastifyRequest, res) {
        const params = googleClient.callbackParams(req.raw); // <- throws the error
        const tokenSet = await googleClient.callback('https://client.example.com/callback', params, { nonce: nonces.val });
        console.log('received and validated tokens %j', tokenSet);
        console.log('validated ID Token claims %j', tokenSet.claims().email);
    });

Expected behaviour The http.IncomingMessage type does not include a body property by default.

Although the documentation mentions that the body must be parsed before calling this function, this seems to be a design flaw. If the function accepts a parameter of a specific type (http.IncomingMessage), it should be capable of handling that type without throwing an error. The possible solutions are either to removehttp.IncomingMessage from the accepted types or to extend the accepted type to include the body property.

Environment:

Additional context Add any other context about the problem here.

panva commented 1 week ago

Oh wait so it is clearly documented for when the IncomingMessage is a POST one?

panva commented 1 week ago

Anyway, v6.x is right around the corner with a different API. So I won't be making any changes to this.