Passport NestJS on Microservice | NestJS | Page 1

normal valve Dec 28, 2022, 4:30 AM

#

i have some passport problem with NestJS

i used passport with NestJS to make Guard extent from AuthGuard
source: https://github.com/nestjs/passport/blob/master/lib/auth.guard.ts

but every time auth an error occurs
please support me

GitHub

passport/auth.guard.ts at master · nestjs/passport

Passport module for Nest framework (node.js) 🔑. Contribute to nestjs/passport development by creating an account on GitHub.

vagrant summit Dec 28, 2022, 6:09 AM

#

Why are you using passport on a microservice?

normal valve Dec 28, 2022, 7:00 AM

#

for authentication of JWT

#

@vagrant summit this is my current resource, I'm devloping the JWT part https://github.com/SangVoM/boilerplate-microserve-nestjs

GitHub

GitHub - SangVoM/boilerplate-microserve-nestjs

Contribute to SangVoM/boilerplate-microserve-nestjs development by creating an account on GitHub.

vagrant summit Dec 28, 2022, 7:23 AM

#

But why? Shouldn't your microservice be behind a tunnel the only you can access so if the request is authenticated at the gateway it should be fine for the microservice?

normal valve Dec 28, 2022, 7:24 AM

#

I just ask it to authenticate at the api_gateway

#

it will be ok to validate at input

normal valve Dec 28, 2022, 10:21 AM

#

any suggestions for me

#

🥲

vagrant summit Dec 28, 2022, 2:25 PM

#

What kind of suggestion are you looking for?

normal valve Dec 28, 2022, 2:58 PM

#

I don't understand from where does passport.authenticate get its info?

vagrant summit Dec 28, 2022, 2:59 PM

#

Info as in the info variable, or just the information it uses in general?

normal valve Dec 28, 2022, 2:59 PM

#

info variable

vagrant summit Dec 28, 2022, 3:00 PM

#

Third parameter of the callback. I'd have to dig through passport's code to tell you exactly how it gets too the

normal valve Dec 28, 2022, 3:02 PM

#

Is this info the user's info ?

vagrant summit Dec 28, 2022, 3:04 PM

#

No, that should be the user parameter, IIRC

normal valve Dec 28, 2022, 3:06 PM

#

So what is it i'm getting undefined there and giving error.

vagrant summit Dec 28, 2022, 3:07 PM

#

Where are you getting undefined?

normal valve Dec 28, 2022, 3:07 PM

#

here function canActivate

#

has data user and undefined info

vagrant summit Dec 28, 2022, 3:09 PM

#

Again, I'd have to dig through passport's code to remember what info is supposed to be. Are you getting an error at all, or is the value just undefined she you want to know why?

normal valve Dec 28, 2022, 3:10 PM

#

Yes, please. Thanks

vagrant summit Dec 28, 2022, 3:10 PM

#

That wasn't a yes or no question

normal valve Dec 28, 2022, 3:12 PM

#

I'm getting the above error because no one can help me so I'm looking for a suggestion

#

if you could see my code and give me the answer that would be great

vagrant summit Dec 28, 2022, 3:12 PM

#

What error. The unauthorized error?

normal valve Dec 28, 2022, 3:13 PM

#

#

the errors

vagrant summit Dec 28, 2022, 3:13 PM

#

This is still in your microservice, right?

normal valve Dec 28, 2022, 3:13 PM

#

yes

vagrant summit Dec 28, 2022, 3:13 PM

#

Can you show your jwt strategy?

normal valve Dec 28, 2022, 3:14 PM

#

here men'

vagrant summit Dec 28, 2022, 3:15 PM

#

What transport are you using for your microservice? More than likely, what is becoming the req object doesn't have a headers property and thus passport can't read the authorization header to get the jwt for verification.

#

That's why I said authentication should be done at the gateway rather than in the microservice itself

normal valve Dec 28, 2022, 3:18 PM

#

What transport are you using for your microservice => I use Redis

vagrant summit Dec 28, 2022, 3:18 PM

#

Yeah pretty sure redis requests don't have headers

normal valve Dec 28, 2022, 3:20 PM

#

More than likely, what is becoming the req object doesn't have a headers property and thus passport can't read the authorization header to get the jwt for verification. => I don't know if I misunderstood the question but my request still has header

vagrant summit Dec 28, 2022, 3:21 PM

#

Is that inside the gateway or the microservice? How are you checking the request?

#

All of that looks like express's request object, which wouldn't exist inside the microservice

normal valve Dec 28, 2022, 3:23 PM

#

That's why I said authentication should be done at the gateway rather than in the microservice itself => i'm validating it on the outermost layer
request at api_gateway =>. redis => app_service and returned api_gateway as proof that my channels pay data and right at JwtStrategy I get user login information

vagrant summit Dec 28, 2022, 3:27 PM

#

Okay so you are authenticating at the gateway? That's good.

normal valve Dec 28, 2022, 3:27 PM

#

Is that inside the gateway or the microservice? How are you checking the request? => it's inside of gateway, i'm checking its log when requesting 1 JWT at gateway's JWTGuand

vagrant summit Dec 28, 2022, 3:28 PM

#

Can you show me your JwtGuard? It's just a simple extends AuthGuard('jwt') right?

normal valve Dec 28, 2022, 3:29 PM

#

#

RPCAuthGuard custom from https://github.com/nestjs/passport/blob/master/lib/auth.guard.ts

GitHub

passport/auth.guard.ts at master · nestjs/passport

Passport module for Nest framework (node.js) 🔑. Contribute to nestjs/passport development by creating an account on GitHub.

vagrant summit Dec 28, 2022, 3:30 PM

#

If you're doing this inside your gateway, then why are you switching to rpc?

normal valve Dec 28, 2022, 3:32 PM

#

it's just naming RPCAuthGuard it's no different from Auth.guard and I'm applying the mechanism of RPC

vagrant summit Dec 28, 2022, 3:33 PM

#

You're doing authentication in your gateway, right?

normal valve Dec 28, 2022, 3:33 PM

#

Yes, your check my source code from me: https://github.com/SangVoM/boilerplate-microserve-nestjs

GitHub

GitHub - SangVoM/boilerplate-microserve-nestjs

Contribute to SangVoM/boilerplate-microserve-nestjs development by creating an account on GitHub.

#

please wait update authenticate

#

@vagrant summit i'm updated

#

can your run docker in local and check it authentication in gateway

vagrant summit Dec 28, 2022, 3:44 PM

#

How would I hit your server? I don't see any endpoints, just @RpcMethod()s

normal valve Dec 28, 2022, 3:47 PM

#

Host: http://localhost:3001/rpc/v1

#

#

{ "jsonrpc": "2.0", "id": 1, "method": "user.register", "params": { "username": "sangvm", "email": "sang.vo@smartdev.com", "password": "123123123", "passwordConfirm": "123123123" }

vagrant summit Dec 28, 2022, 3:48 PM

#

Where do you define that endpoint?

normal valve Dec 28, 2022, 3:49 PM

#

on method

vagrant summit Dec 28, 2022, 3:49 PM

#

Maybe I wasn't clear: where do you define the POST /rpc/v1 endpoint in your server?

normal valve Dec 28, 2022, 3:52 PM

#

can you open file main.ts I open one path in here. It read on file application.yml

#

and NestJS give me a function connectMicroservice to do it

vagrant summit Dec 28, 2022, 3:53 PM

#

Okay. I see

#

That wasn't what I meant by "do subscription in the gateway"

#

I meant you should be doing it on an http route handler you have control of

#

Because what your doing now, it doesn't matter if it's in the "gateway" application or some server called "puppies", the authentication is being done in the microservice portion of the request, not the HTTP portion

#

Passport being an express middleware was really only designed for HTTP.

#

If you can wait for a bit, I'm sure I can finagle some sort of solution where authentication can be done with passport and JSON rpc with your example, but I still think that it should be handled by an http route handler you have control over

normal valve Dec 28, 2022, 3:59 PM

#

If you can wait for a bit, I'm sure I can finagle some sort of solution where authentication can be done with passport and JSON rpc with your example => Yes can you give me example with it

#

I still think that it should be handled by an http route handler you have control over => I will update it if there is no other solution or next version

#

If yes, can you contribute to me? 🙏

#

@vagrant summit do you need me to send you .env to check it.

vagrant summit Dec 28, 2022, 7:53 PM

#

All I ended up having to do was add this method to your JWTGuard

  getRequest(context: ExecutionContext) {
    return context.switchToRpc().getContext().req;
  }

This way, req.headers is populated for passport, because it reads off of the request object that Nest knows to pass to it. Normally, this is context.switchToHttp().getRequest(), but you have to do some custom work to make it fine in your JSONRPC context

normal valve Dec 29, 2022, 1:33 AM

#

I think it's the same have you tested it?
return context.switchToRpc().getContext().req; same context.switchToRpc().getContext()['req'];

vagrant summit Dec 29, 2022, 1:34 AM

#

That would be the same, yes

normal valve Dec 29, 2022, 1:36 AM

#

handleRequest(err, user, info, context: ExecutionContext, status): TUser { if (err || !user || !context.switchToRpc() || !info || !status) { throw err || new UnauthorizedException(); } return user; }
both things get req and generate error, in my log it says error at

vagrant summit Dec 29, 2022, 1:41 AM

#

Did you actually add the getRequest

normal valve Dec 29, 2022, 1:42 AM

#

I tried your getRequest put in the code and test

vagrant summit Dec 29, 2022, 1:44 AM

#

Well, it worked for me when I just used that added method

normal valve Dec 29, 2022, 1:44 AM

#

Can you show me screen code?

#

Are you trying this medthod ?
{ "jsonrpc": "2.0", "id": 1, "method": "user.get_info_user", "params": {} }

vagrant summit Dec 29, 2022, 1:56 AM

#

normal valve Are you trying this medthod ? `{ "jsonrpc": "2.0", "id": 1, "method"...

I did and it works so long as there's an authorization header

normal valve Dec 29, 2022, 1:57 AM

#

not works from me 🥲

vagrant summit Dec 29, 2022, 1:58 AM

#

import { CodeErrorRpcException, JsonRpcContext } from "../microservice/rpc";
import { ExecutionContext, HttpStatus, Injectable } from "@nestjs/common";
import { RPCAuthGuard } from "./rpc-auth.guard";
import { LoggerService } from "../logger/logger.service";
import { HttpStatusMessage } from "../message/http-status.message";

@Injectable()
export class JWTGuard extends RPCAuthGuard("jwt") {
  private unauthorizedError = new CodeErrorRpcException(
    HttpStatusMessage.UNAUTHORIZED,
    HttpStatus.UNAUTHORIZED
  );
  canActivate(context: ExecutionContext) {
    try {
      LoggerService.log("#JWTGuard.canActivate", JWTGuard.name);
      const authData = context
        .switchToRpc()
        .getContext<JsonRpcContext>()
        .getMetadataByKey("Authorization");
      if (!authData) {
        LoggerService.error(
          "#JWTGuard.canActivate",
          this.unauthorizedError.stack,
          JWTGuard.name
        );
        throw this.unauthorizedError;
      }
      return super.canActivate(context);
    } catch (e) {
      throw this.unauthorizedError;
    }
  }

  getRequest(context: ExecutionContext) {
    return context.switchToRpc().getContext().req;
  }
}

normal valve Dec 29, 2022, 2:00 AM

#

getRequest in JWTGuand for what I don't see any function calling it here ?

vagrant summit Dec 29, 2022, 2:01 AM

#

Getting a 500 might actually be correct here. Microservices work differently when it comes to errors. You need to catch the error that's been serialized by the microservice and deserialize it in the http gateway

vagrant summit Dec 29, 2022, 2:01 AM

#

normal valve `getRequest` in `JWTGuand` for what I don't see any function calling it here ?

The AuthGuard class calls it. This sub class overrides the original to customize how the sub class functions

normal valve Dec 29, 2022, 2:03 AM

#

vagrant summit The `AuthGuard` class calls it. This sub class overrides the original to customi...

So in the RPCAuthGuand class, did you edit anything to call getRequest in the parent class ?

vagrant summit Dec 29, 2022, 2:04 AM

#

normal valve So in the `RPCAuthGuand` class, did you edit anything to call `getRequest` in th...

No, it should already extend the AuthGuard right?

normal valve Dec 29, 2022, 2:13 AM

#

vagrant summit No, it should already extend the `AuthGuard` right?

No, current extend the RPCAuthGuard.

vagrant summit Dec 29, 2022, 2:17 AM

#

Your RPCAuthGuard calls that method

normal valve Dec 29, 2022, 2:19 AM

#

vagrant summit ```ts import { CodeErrorRpcException, JsonRpcContext } from "../microservice/rpc...

I tried this code not works and JWTGuard extends RPCAuthGuard('jwt')

normal valve Dec 29, 2022, 2:20 AM

#

vagrant summit Your `RPCAuthGuard` calls that method

I don't quite understand this question

vagrant summit Dec 29, 2022, 2:23 AM

#

normal valve I don't quite understand this question

Not a question. It was a statement

normal valve Dec 29, 2022, 2:25 AM

#

vagrant summit I did and it works so long as there's an authorization header

if it works can you push to the code work from your side

vagrant summit Dec 29, 2022, 2:53 AM

#

Well, "works" in that I get a 500 back and a proper log that says what the error is. To get a 403/401 bank you need to deserialize the error, as I already mentioned. I'll make a fork and pull tomorrow most likely

normal valve Dec 29, 2022, 3:10 AM

#

maybe you will need it.

#

I will debug and see if there is any related information I will send you

vagrant summit Dec 29, 2022, 5:12 PM

#

Request:

xh :3001/rpc/v1 jsonrpc="2.0" id="1" method="user.get_info_user" Authorization:"Bearer some.token.json"

Log/error (expected)

LOG:  false JsonWebTokenError: invalid token
    at Object.module.exports [as verify] (~/node_modules/.pnpm/jsonwebtoken@9.0.0/node_modules/jsonwebtoken/verify.js:82:17)
    at Function.module.exports [as JwtVerifier] (~/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/verify_jwt.js:4:16)
    at ~/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/strategy.js:104:25
    at JwtStrategy._secretOrKeyProvider (~/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/strategy.js:40:13)
    at JwtStrategy.authenticate (~/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/strategy.js:99:10)
    at attempt (~/node_modules/.pnpm/passport@0.6.0/node_modules/passport/lib/middleware/authenticate.js:369:16)
    at authenticate (~/node_modules/.pnpm/passport@0.6.0/node_modules/passport/lib/middleware/authenticate.js:370:7)
    at ~/src/common/guard/rpc-auth.guard.ts:118:9
    at new Promise (<anonymous>)
    at ~/src/common/guard/rpc-auth.guard.ts:106:5
[ERROR][12/29/2022, 9:10:52 AM] [RpcExceptionsHandler] Unauthorized +13ms
UnauthorizedException: Unauthorized
    at JWTGuard.handleRequest (~/src/common/guard/rpc-auth.guard.ts:91:22)
    at ~/src/common/guard/rpc-auth.guard.ts:60:16
    at ~/src/common/guard/rpc-auth.guard.ts:110:26
    at allFailed (~/node_modules/.pnpm/passport@0.6.0/node_modules/passport/lib/middleware/authenticate.js:110:18)
    at attempt (~/node_modules/.pnpm/passport@0.6.0/node_modules/passport/lib/middleware/authenticate.js:183:28)
    at JwtStrategy.strategy.fail (~/node_modules/.pnpm/passport@0.6.0/node_modules/passport/lib/middleware/authenticate.js:305:9)
    at ~/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/strategy.js:106:33
    at Object.module.exports [as verify] (~/node_modules/.pnpm/jsonwebtoken@9.0.0/node_modules/jsonwebtoken/verify.js:82:12)
    at Function.module.exports [as JwtVerifier] (~/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/verify_jwt.js:4:16)

vagrant summit Dec 29, 2022, 5:40 PM

#

When I actually went through and created a method to generate a token, then used that token on the get_info_user it worked (besides waiting for a response cause I'm only running one of your servers). I'll have to clean up the diffs because prettier is running automatically and cleaning a lot of your code to its standards so give me a bit. Just wanted to show what the request looks like and what's happening

#

normal valve Dec 30, 2022, 1:34 AM

#

Yes thanks, i'm not finding the cause of it either, even though i got the user info

normal valve Dec 30, 2022, 1:41 AM

#

vagrant summit Request: ```sh xh :3001/rpc/v1 jsonrpc="2.0" id="1" method="user.get_info_user" ...

this is the log i sent you, i'm having problem in RPCAuthGuard it can't return user info and got error in handleRequest

vagrant summit Dec 30, 2022, 1:43 AM

#

normal valve this is the log i sent you, i'm having problem in `RPCAuthGuard` it can't return...

For me, the error came from an invalid jwt

normal valve Dec 30, 2022, 1:59 AM

#

vagrant summit For me, the error came from an invalid jwt

obviously get the user information but why is the error message Invalid token ? 🤔

vagrant summit Dec 30, 2022, 2:00 AM

#

Cause I legitimately sent something that wasn't a jwt

#

some.token.json

normal valve Dec 30, 2022, 2:18 AM

#

vagrant summit Cause I legitimately sent something that wasn't a jwt

If you send something like jwt then it's correct, because the current code can't decode something like jwt

normal valve Dec 30, 2022, 4:35 AM

#

vagrant summit ```ts import { CodeErrorRpcException, JsonRpcContext } from "../microservice/rpc...

I found a solution for it thanks to your suggestion
handleRequest(err, user, info, context: ExecutionContext) { if (err || info || !user) { throw err || info || this.unauthorizedError; } handleRpcRequest(user, UserShowDto, UserInfo, context.switchToRpc()); return user; }

#

it's the same as the getRequest you suggested

#Passport NestJS on Microservice