Express+Auth0登录重定向异常或State验证失败问题求助

我有一个运行多年的Node.js Express应用和REST API，一直存在一个问题：用户访问受中间件保护的URL时，登录后总是重定向到站点根目录，而非原请求的URL。查过Stack Overflow、Auth0社区帖子，试过多种方案都没解决。

相关代码实现 #

app.js配置 #

var strategy = new Auth0Strategy(
  {
    domain: process.env.AUTH0_DOMAIN,
    clientID: process.env.AUTH0_CLIENTID,
    clientSecret: process.env.AUTH0_CLIENT_SECRET,
    callbackURL: process.env.AUTH0_CALLBACK_URL || 'http://127.0.0.1:3000/callback'
  },
  function (accessToken, refreshToken, extraParams, profile, done) {
    // accessToken is the token to call Auth0 API (not needed in the most cases)
    // extraParams.id_token has the JSON Web Token
    // profile has all the information from the user
    return done(null, profile);
  }
);

passport.use(strategy);

// You can use this section to keep a smaller payload
passport.serializeUser(function (user, done) {
  done(null, user);
});

passport.deserializeUser(function (user, done) {
  done(null, user);
});

// config express-session
var sess = {
  secret: 'ThisisMySecret',
  cookie: {
    httpOnly:false,
    secure:false
  },
  resave: false,
  saveUninitialized: false
};
if (app.get('env') === 'prod') {
  console.log("prod environment")
  app.set('trust proxy', 1); // trust first proxy
  sess.cookie.secure = true; // serve secure cookies, requires https
  sess.proxy = true;
}  

app.use(session(sess));
app.use(passport.initialize());
app.use(passport.session());

登录路由 #

router.get('/login', function(req, res, next) {
  req.session.returnTo = req.query.returnTo; // Store the returnTo value in session
  console.log("inside login route: " + req.session.returnTo)
  const state = uuidv4(); 
  passport.authenticate('auth0', {
    scope: 'openid email profile',
    state: state // Pass the returnTo value as the state parameter
  })(req, res, next);
});

回调路由 #

router.get('/callback', function(req, res, next) {
  console.log("inside callback route: " + req.session.returnTo)
  passport.authenticate('auth0', function(err, user, info) {
    console.log("inside callback authenticate function: " + req.session.returnTo)
    console.log(user)
    console.log(info)
    if (err) { return next(err); }
    if (!user) {
      console.log(user)
      console.log(info)
      res.render('beta/failed-login', {
        static_path:'/static',
        theme:process.env.THEME || 'flatly',
        pageTitle : "Access Denied",
        pageDescription : "Access Denied",
        query:req.query
      });
    } else {
      req.logIn(user, function (err) {
        if (err) {console.log(err); return next(err); }
        console.log("inside callback route: " + req.session.returnTo)
        console.log("user inside callback route: " + user)
        const returnTo = req.session.returnTo || '/'; // Retrieve the returnTo value from session
        delete req.session.returnTo; // Remove the returnTo value from session
        res.redirect(returnTo);
      });
    }
  })(req, res, next);
});

认证中间件 #

function secured(req, res, next) {
  if (req.isAuthenticated()) {
    return next();
  }
  console.log("query in middleware: " + req.query.state)
  console.log("originalUrl in middleware: " + req.originalUrl)
  const returnTo = req.query.state || req.originalUrl;
  req.session.returnTo = returnTo; // Store the returnTo value in session
  console.log("returnTo in middleware: " + returnTo)
  console.log("session.returnTo in middleware: " + req.session.returnTo)
  res.redirect('/login?returnTo=' + encodeURIComponent(returnTo));
}

示例受保护路由 #

router.get('/user', secured,async function (req, res) {
  const { _raw, _json, userProfile } = req.user;
  console.log(req.user)
  res.render('beta/user', {
    userProfile: JSON.stringify(userProfile, null, 2),
    static_path:'/static',
    theme:process.env.THEME || 'flatly',
    pageTitle : "User Profile",
    pageDescription : "User Profile",
  });
});

日志输出（访问/user时） #

Server running at http://127.0.0.1:3000/
query in middleware: undefined
originalUrl in middleware: /user
returnTo in middleware: /user
session.returnTo in middleware: /user
inside login route: /user
inside callback route: /user
inside callback authenticate function: /user
false
{ message: 'Unable to verify authorization request state.' }
false
{ message: 'Unable to verify authorization request state.' }

问题现象 #

• 移除/login路由中passport.authenticate调用里的state: state参数后，登录可成功，但仍无法重定向到原URL，始终跳转到根目录。
• 本地环境和Heroku生产环境均存在此问题，Auth0日志显示登录成功但授权码交换未成功。

解决方案 #

1. 修复State验证失败问题 #

Passport-Auth0中间件会自动处理state的生成、存储和验证，用于CSRF保护。手动指定state参数会导致中间件无法验证其有效性，直接引发"Unable to verify authorization request state."错误，导致授权码交换失败。

修改登录路由，移除手动生成和指定的state：

router.get('/login', function(req, res, next) {
  req.session.returnTo = req.query.returnTo;
  console.log("inside login route: " + req.session.returnTo)
  
  passport.authenticate('auth0', {
    scope: 'openid email profile'
    // 移除手动指定的state参数，让Passport自动处理
  })(req, res, next);
});

2. 优化returnTo传递逻辑 #

中间件中req.query.state是Auth0的CSRF保护参数，并非我们的原请求URL，因此可以简化中间件的returnTo处理：

function secured(req, res, next) {
  if (req.isAuthenticated()) {
    return next();
  }
  console.log("originalUrl in middleware: " + req.originalUrl)
  const returnTo = req.originalUrl;
  req.session.returnTo = returnTo;
  console.log("returnTo in middleware: " + returnTo)
  console.log("session.returnTo in middleware: " + req.session.returnTo)
  res.redirect('/login?returnTo=' + encodeURIComponent(returnTo));
}

3. 确认Session配置有效性 #

确保session配置中，当生产环境使用HTTPS时，cookie.secure和proxy设置正确（你的代码已正确配置）。另外，saveUninitialized: false不会影响，因为当你给req.session.returnTo赋值时，session会被标记为已初始化并自动保存。

修复后流程说明 #

1. 用户访问/user，被secured中间件拦截，将/user存入req.session.returnTo，跳转到/login?returnTo=/user。
2. 登录路由将req.query.returnTo存入session（中间件已存，此步骤可保留或移除，不影响结果）。
3. Passport自动生成state并跳转到Auth0登录页面，state会自动存储到session中。
4. 用户登录成功后，Auth0回调到/callback，Passport自动验证state的有效性，完成用户认证。
5. 回调路由读取session.returnTo，重定向到原请求的/user，并删除session中的returnTo参数。

内容的提问来源于stack exchange，提问作者Neil Cooper