feathers: [v4] oauth authentication faild with error=Grant session

Google oauth was working properly when I was using v3, but after I migrated to v4, I was unable to authenticate anymore. After I authenticate using Google it redirects to https://exampe.com/oauth/connect/google/callback?code=… and displays the following error on the page:

error=Grant%3A%20missing%20session%20or%20misconfigured%20provider

default.json

{
..
"authentication": {
    "secret": "JWT_SECRET",
    "entity": "user",
    "service": "users",
    "authStrategies": [
      "jwt",
      "local"
    ],
    "path": "/authentication",
    "jwtOptions": {
      "header": {
        "typ": "access"
      },
      "issuer": "feathers",
      "algorithm": "HS256",
      "expiresIn": "1d"
    },
    "local": {
      "entity": "user",
      "usernameField": "email",
      "passwordField": "password"
    },
    "oauth": {
      "redirect": "REDIRECT",
      "defaults": {
        "protocol": "PROTOCOL",
        "host": "HOST"
      },
      "google": {
        "key": "GOOGLE_AUTH_CLIENT_ID",
        "secret": "GOOGLE_AUTH_CLIENT_SECRET",
        "scope": ["profile openid email"]
      },
      "facebook": {
        "key": "FB_AUTH_CLIENT_ID",
        "secret": "FB_AUTH_CLIENT_SECRET",
        "profileFields": [
          "id",
          "displayName",
          "first_name",
          "email",
          "gender",
          "profileUrl",
          "birthday",
          "picture",
          "permissions"
        ]
      }
    }
  },
..
}

authentication.js

const { AuthenticationService, JWTStrategy } = require('@feathersjs/authentication');
const { LocalStrategy } = require('@feathersjs/authentication-local');
const authenticationOauth = require('@feathersjs/authentication-oauth');
const { express: oauth, OAuthStrategy } = authenticationOauth

module.exports = app => {
  const config = app.get('authentication');
  app.set('authentication', config)
  const authentication = new AuthenticationService(app, 'authentication');
  authentication.register('jwt', new JWTStrategy());
  authentication.register('local', new LocalStrategy());
  authentication.register('google', new OAuthStrategy())
  authentication.register('facebook', new OAuthStrategy())
  app.use('/authentication', authentication);
  app.configure(oauth());
};

app.js

..
app.configure(authentication);
..

Thanks in advance for any advice!

About this issue

  • Original URL
  • State: closed
  • Created 5 years ago
  • Reactions: 1
  • Comments: 22 (9 by maintainers)

Most upvoted comments

I am getting the same error with both facebook and google.

Here’s my config:

{
  "host": "localhost",
  "port": 3030,
  "public": "../public/",
  "paginate": {
    "default": 10,
    "max": 200
  },
  "authentication": {
    "entity": "user",
    "service": "users",
    "secret": "secret",
    "authStrategies": [
      "jwt",
      "local"
    ],
    "jwtOptions": {
      "header": {
        "typ": "access"
      },
      "audience": "https://yourdomain.com",
      "issuer": "feathers",
      "algorithm": "HS256",
      "expiresIn": "30d"
    },
    "local": {
      "usernameField": "email",
      "passwordField": "password"
    },
    "oauth": {
      "redirect": "OAUTH_REDIRECT_URL",
      "facebook": {
        "key": "FACEBOOK_APP_ID",
        "secret": "FACEBOOK_APP_SECRET",
        "scope": ["email, public_profile"]
      },
      "google": {
        "key": "GOOGLE_PROJECT_ID",
        "secret": "GOOGLE_PROJECT_SECRET",
        "scope": [ "email", "profile", "openid" ]
      }
    }
  },
  "mongodb": "MONGODB_URL"
}

And this is my authentication service

const { AuthenticationService, JWTStrategy } = require('@feathersjs/authentication');
const { LocalStrategy } = require('@feathersjs/authentication-local');
const { expressOauth, OAuthStrategy } = require('@feathersjs/authentication-oauth');
const axios = require('axios');

class FacebookStrategy extends OAuthStrategy {
  async getProfile (authResult) {
    // This is the oAuth access token that can be used
    // for Facebook API requests as the Bearer token
    const accessToken = authResult.access_token;

    const { data } = await axios.get('https://graph.facebook.com/me', {
      headers: {
        authorization: `Bearer ${accessToken}`
      },
      params: {
        // There are
        fields: 'id,name,email,picture'
      }
    });

    return data;
  }

  async getEntityData(profile) {
    // `profile` is the data returned by getProfile
    const baseData = await super.getEntityData(profile);

    return {
      ...baseData,
      isVerified: true,
      displayName: profile.name,
      name:  profile.name,
      email: profile.email
    };
  }
}

class GoogleStrategy extends OAuthStrategy {
  async getEntityData(profile) {

    // this will set 'googleId'
    const baseData = await super.getEntityData(profile);

    // this will grab the picture and email address of the Google profile
    return {
      ...baseData,
      isVerified: true,
      profilePicture: profile.picture,
      email: profile.email
    };
  }
}

module.exports = app => {
  const authentication = new AuthenticationService(app);

  authentication.register('jwt', new JWTStrategy());
  authentication.register('local', new LocalStrategy());
  authentication.register('facebook', new FacebookStrategy());
  authentication.register('google', new GoogleStrategy());

  app.use('/authentication', authentication);
  app.configure(expressOauth());
};

It doesn’t matter whether I accept or cancel the login request, it sends me to this url: http://localhost:3030/oauth/connect/google/callback?code=4%2FtQF8-vzUPx56ArlBz1WJYz3o5v_eQG0xSDZ87Xk41lA6K7cZXkk3gnpyGo5rnAwNVILxzQo_l6BHltHizyE7scs&scope=email%20profile%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile%20openid&authuser=0&session_state=31a9e2ae84bacfd25937d816f078ac409e57682e..3240&prompt=consent#

and there’s always the same error: error=Grant%3A%20missing%20session%20or%20misconfigured%20provider

I updated all the libraries to the latest versions and still it’s not working.

However, everything seems to be working fine when I use the feathers-chat app.

I tracked down the grant callback endpoint and I just wanted to see what are the values of the session and provider.

In my app, both of them were empty objects {}, and this is why grant throws that error.

In the feathers-chat app, this is how they look like:

session { provider: 'facebook',
  response: { error: { error: [Object] } } }
provider { authorize_url: 'https://www.facebook.com/dialog/oauth',
  access_url: 'https://graph.facebook.com/oauth/access_token',
  oauth: 2,
  path: '/oauth',
  host: 'localhost:3030',
  protocol: 'http',
  transport: 'session',
  key: 'my_fb_app_key',
  secret: 'my_fb_app_secret',
  callback: 'http://localhost:3030/oauth/facebook/authenticate',
  redirect_uri: 'http://localhost:3030/oauth/facebook/callback',
  name: 'facebook',
  facebook: 

The `session` is `req.session.grant`. In my app, `req.session.grant` is not defined, while in the feathers-chat app,  `req.session.grant` is `{ provider: 'facebook' }`


I'd be very happy to track it further, but I'm not familiar with feathers or feathers authentication. Can someone help me, please?
{
      "google": {
        "key": "**",
        "secret": "**",
        "scope": ["email", "profile", "openid"],
        "nonce": true
      },
      "github": {
        "key": "**",
        "secret": "**"
      }
}

My config works in localhost but not working in my domain account.seongland.com

{
   "redirect_uri": "https://account.seongland.com/oauth/google/callback",
   "callback": "/oauth/google/authenticate"
}
        "subdomain": "account",

I tested to add this configs, but both did not worked (or added together)

/oauth/connect/github or google/callback?code=** this page shows error=Grant%3A%20missing%20session%20or%20misconfigured%20provider

Error image

My localhost config is working but I can’t configure why my production configuration is not working The only difference is host, key, secret, port

Is there any information related to this issue?