Resolve Google/GitHub OAuth sign-in redirect issues#59
Merged
Conversation
aichannode
temporarily deployed
to
fix/signin-google-auth-and-redirect - forgeng-backend PR #59
Render
Destroyed
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Backend coverageBackend coverage
|
Frontend coverageFrontend coverage
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
targets the frontend's
/api/auth/exchangebridge, since that route can'tread the httpOnly cookie set on the backend's origin and was silently
failing to establish a session.
/sign-into theirrole's home page, instead of leaving them stuck on the form after the
OAuth callback bounces them back through
/api/auth/exchange→/auth/callback→/sign-in.JWT_ACCESS_SECRETrequirement infrontend/.env.exampleand
README.md— the callback andmiddleware.tsverify the access-tokencookie locally, so a missing/mismatched secret breaks OAuth sign-in
without any visible error.
Test plan
backend:npx jest test/unit/modules/auth/auth.controller.spec.tson your role's home page instead of bouncing back to
/sign-in/sign-inwhile already logged in and confirm you're redirectedhome instead of seeing the form