Express集成Auth0时Callback路由无法执行代码的问题

我在Express后端集成Auth0，用express-openid-connect处理认证逻辑，但遇到了callback路由的问题：请求能在网络面板看到，服务器中间件也能记录到，但路由内的console.log和重定向代码完全不执行，登录后Auth0只会重定向到请求源（比如localhost:8000/）。

初始代码（server.ts精简版） #

const app: Express = express();
const port = 8000;

export const auth0Config: ConfigParams = {
  authRequired: false,
  auth0Logout: true,
  secret: process.env.AUTH_SECRET,
  baseURL: 'http://localhost:8000',
  clientID: process.env.AUTH0_CLIENT_ID,
  issuerBaseURL: process.env.AUTH0_DOMAIN,
  session: {
    cookie: {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
    },
    rolling: true,
    absoluteDuration: 86400, // 1 day
  },
  authorizationParams: {
    scope: 'openid profile email',
  },
};

app.use(express.urlencoded({ extended: false })); // required to handle urlencoded requests
app.use(express.json()); // required to handle form-data request
app.use(cors()); // middleware to enable CORS requests

// middleware to log request to the console
app.use((req, res, next) => {
  console.log(`Request: ${req.method} ${req.url}`);
  next();
});

app.use(auth(auth0Config));

app.post('/callback', (req, res) => {
  console.log('Callback route reached - TEST 2');
  res.redirect('http://localhost:3000');
});

app.get('/', (req, res) => {
  res.send(req.oidc.isAuthenticated() ? 'Logged in' : 'Logged out');
});

Auth0控制台URL配置 #

调整后的代码（可运行但逻辑混乱） #

export const auth0Config: ConfigParams = {
  authRequired: false,
  auth0Logout: true,
  secret: process.env.AUTH_SECRET,
  baseURL: 'http://localhost:8000',
  clientID: process.env.AUTH0_CLIENT_ID,
  issuerBaseURL: process.env.AUTH0_DOMAIN,
  session: {
    cookie: {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
    },
    rolling: true,
    absoluteDuration: 86400, // 1 day
  },
  authorizationParams: {
    scope: 'openid profile email',
  },
  routes: {
    login: false,
    callback: false,
  },
};

app.get('/login', (req, res) =>
  res.oidc.login({
    returnTo: '/post-login',
    authorizationParams: {
      redirect_uri: 'http://localhost:8000/callback',
    },
  })
);

app.post('/callback', express.urlencoded({ extended: false }), (req, res) =>
  res.oidc.callback({
    redirectUri: 'http://localhost:8000/callback',
  })
);

app.get('/post-login', (req, res) => {
  console.log('Callback route reached - TEST 2 - get');
  res.redirect('/profile');
});

清晰解决方案 #

核心问题 #

express-openid-connect默认会自动生成/callback路由，你手动定义的同名路由会被中间件覆盖，导致自定义代码无法执行。

关键概念理清 #

• redirect_uri：Auth0完成认证后回调到后端的地址，必须和Auth0控制台的「Allowed Callback URLs」完全一致，这是Auth0服务器的回调目标。
• returnTo：后端完成认证处理后，重定向到前端/内部页面的地址，这是Express应用的跳转目标。

规范实现代码 #

const app: Express = express();
const port = 8000;

export const auth0Config: ConfigParams = {
  authRequired: false,
  auth0Logout: true,
  secret: process.env.AUTH_SECRET,
  baseURL: 'http://localhost:8000',
  clientID: process.env.AUTH0_CLIENT_ID,
  issuerBaseURL: process.env.AUTH0_DOMAIN,
  session: {
    cookie: {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
    },
    rolling: true,
    absoluteDuration: 86400, // 1天有效期
  },
  authorizationParams: {
    scope: 'openid profile email',
  },
  // 禁用默认路由，允许自定义登录和回调逻辑
  routes: {
    login: false,
    callback: false,
  },
};

// 中间件顺序必须遵循：解析请求体 → CORS → 日志 → Auth0中间件
app.use(express.urlencoded({ extended: false }));
app.use(express.json());
app.use(cors());

app.use((req, res, next) => {
  console.log(`Request: ${req.method} ${req.url}`);
  next();
});

// 挂载Auth0核心中间件
app.use(auth(auth0Config));

// 自定义登录路由：触发Auth0认证流程
app.get('/login', (req, res) => {
  res.oidc.login({
    // 认证完成后，后端跳转到前端的地址
    returnTo: 'http://localhost:3000',
    authorizationParams: {
      // 必须与Auth0控制台的Allowed Callback URLs完全匹配
      redirect_uri: 'http://localhost:8000/callback',
    },
  });
});

// 自定义回调路由：处理Auth0返回的认证信息
app.post('/callback', express.urlencoded({ extended: false }), (req, res) => {
  // 这里添加你的自定义逻辑，比如记录登录日志、获取用户信息
  console.log('回调路由触发，用户信息:', req.oidc.user);
  
  // 调用Auth0中间件的callback方法完成认证流程，之后自动跳转到returnTo地址
  res.oidc.callback({
    redirectUri: 'http://localhost:8000/callback', // 与上面的redirect_uri保持一致
  });
});

app.get('/', (req, res) => {
  res.send(req.oidc.isAuthenticated() ? '已登录' : '未登录');
});

app.listen(port, () => {
  console.log(`服务器运行在 http://localhost:${port}`);
});

Auth0控制台配置检查 #

1. 在「Allowed Callback URLs」中添加http://localhost:8000/callback
2. 如果需要跳转到前端http://localhost:3000，需将其添加到「Allowed Logout URLs」和「Allowed Web Origins」中

内容的提问来源于stack exchange，提问作者araghast94