# Passport authenticate in Nodejs hangs

**URL:** <https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625>\
**Category:** OAuth/OIDC\
**Created:** [May 13, 2022, 3:43pm UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625 "2022-05-13T15:43:29Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![mdangelo77](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@mdangelo77](https://devforum.okta.com/u/mdangelo77)\
**Post date:** [May 13, 2022, 3:43pm UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625/1 "2022-05-13T15:43:30Z")

</div>

This is my first project with both passport and Okta in a Nodejs app. I can get the Okta login page, successfully login to Okta, and get redirected to the callback url with a code. This works perfectly.

However, I am having a problem getting the user profile. The call to passport.authenticate in the callback hangs. There are no errors reported or in the log.

I have looked at multiple examples and tried many variations, but I do not see what I am doing wrong. Any idea?

Code segment:

```
    passport.use('oidc', new Strategy({
        issuer: process.env.ISSUER_URL,
        authorizationURL: process.env.AUTH_URL,
        tokenURL: process.env.TOKEN_URL,
        userInfoURL: process.env.USER_URL,
        clientID: process.env.CLIENT_ID,
        clientSecret: process.env.CLIENT_SECRET,
        callbackURL: process.env.CALLBACK_URL,
        scope: 'openid profile'
    }, (issuer, profile, done) => {
        return done(null, profile);
    }));

    passport.serializeUser((user, done) => {
        done(null, user);
    });
    passport.deserializeUser((obj, done) => {
        done(null, obj);
    });

    app.post('/oktalogin', passport.authenticate('oidc'));

    app.use('/authorization-code/callback', function(req,res) {
        passport.authenticate('oidc', { failureRedirect: '/autherror' }),
            (req, res) => { res.redirect('/profile') };
    });

    app.use('/profile', (req, res) => {
        res.render('profile', { USER: req.user });
    });

    app.use('/autherror', (req,res) => {
        res.render('error',{ MSG: "AUTH ERROR" });
    });
```

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [May 13, 2022, 11:27pm UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625/2 "2022-05-13T23:27:49Z")

</div>

Hello,  
Are you able to verify if the /token call is happening?  
If successful you should see a log entry in the Okta System.log. If there is an error in the call it may or may not show up the in the log, depending.

If you check the system.log and see no entry either positive/negative, just to test you might try changing the `tokenURL` in your configuration to a local route capable of handling a POST request and verify that the /token call is even happening.

For reference: [Build Secure Node Authentication with Passport.js and OpenID Connect | Okta Developer](https://developer.okta.com/blog/2018/05/18/node-authentication-with-passport-and-oidc)

---

<div class="post-metadata">

**Author:** ![mdangelo77](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@mdangelo77](https://devforum.okta.com/u/mdangelo77)\
**Post date:** [May 17, 2022, 3:08pm UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625/3 "2022-05-17T15:08:45Z")

</div>

Hi Eric,

Thanks for your response, I don’t have admin access to Okta, but I can verify that it does log me into Okta and returns a code to the callback without a system error. The problem seems to be returning the profile, is there a way to verify if it is, or is not, a CORS problem?

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [May 18, 2022, 6:37am UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625/4 "2022-05-18T06:37:29Z")

</div>

There should be no CORS request for the flow you described. When the code is returned I _assume_ your browser is being 302 back to you Node server correct? This is not a CORS call, but a user-agent redirect.  
Once the Node process receives the code it should make a call to the /token endpoint to retrieve your tokens. This happens from the Node server, so not a CORS call either.

---

<div class="post-metadata">

**Author:** ![mdangelo77](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@mdangelo77](https://devforum.okta.com/u/mdangelo77)\
**Post date:** [May 18, 2022, 1:58pm UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625/5 "2022-05-18T13:58:23Z")

</div>

It does return to the node server callback url and it returns a code. I am working from the following documentation:  
[https://developer.okta.com/docs/guides/sign-into-web-app-redirect/node-express/main/](https://developer.okta.com/docs/guides/sign-into-web-app-redirect/node-express/main/)

This document does not mention making a call to the /token endpoint, am I using the wrong documentation?  
If so, can you send me the correct link?

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [May 20, 2022, 6:55am UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625/6 "2022-05-20T06:55:22Z")

</div>

The sample app works fine for me.

When you run it and login you should see something like:

> express-app@0.0.0 start  
> node --inspect ./bin/www
> 
> Debugger listening on ws://127.0.0.1:9229/39e52bae-4c87-4839-8db0-071537236d2f
> 
> For help, see: [Debugging - Getting Started | Node.js](https://nodejs.org/en/docs/inspector)
> 
> GET /login? 302 7.681 ms - 0  
> GET /authorization-code/callback?code=ZKhUsbdNUNfKY0GWqpMzhNCYHrVnon41VjKmN1sWDwU&state=TzQJUv8AY%2BozCsQXYN4PDcHx 302 619.745 ms - 60  
> GET /profile 304 264.399 ms - -

Can you post the exact output you see.

---

<div class="post-metadata">

**Author:** ![mdangelo77](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@mdangelo77](https://devforum.okta.com/u/mdangelo77)\
**Post date:** [May 20, 2022, 2:32pm UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625/7 "2022-05-20T14:32:39Z")

</div>

Hi Eric,

Thank you for your patience with this issue.

The debugger didn’t work because the app is in production and set up in nginx. However,  
I took a snap shot of the developer tools window, I hope it can help. It gets to the callback?code with  
a status of “pending” then eventually times out. The full value of the “initiator” field is:

.[okta.com/oauth2/v1/authorize/redirect?okta\_key=yCUvSI.](http://okta.com/oauth2/v1/authorize/redirect?okta_key=yCUvSI.)…

I don’t have administrator access to Okta to check the system log. Is it possible that I don’t have privilege  
to read the profile? Could it have something to do with the cookie? I set it up as follows:

app.use (session({ secret: process.env.SESSION, saveUninitialized: true, resave: false, cookie: { maxAge: 60 \* 60 \* 1000 } }));

I appreciate any help you can provide!

 ![Capture.PNG](https://global.discourse-cdn.com/oktadev/original/2X/f/f2378e0119a65b7c28a7a588306ab04871c1c86e.png)

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [May 22, 2022, 9:55pm UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625/8 "2022-05-22T21:55:23Z")

</div>

If you can provide the URL of your Okta Org I can check the logs.

My assumption assuming you did not make any modifications to the sample is after your browser redirects back to Node with the code value, your Node process is failing on the /token call. Most likely timing out. I suggest verifying network connectivity to your Okta Org from the process/system where nginx is running.

Another possibility is nginx is not configured correctly to route to your application for /authorization-code/callback.

---

<div class="post-metadata">

**Author:** ![mdangelo77](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@mdangelo77](https://devforum.okta.com/u/mdangelo77)\
**Post date:** [May 24, 2022, 4:05pm UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625/9 "2022-05-24T16:05:07Z")

</div>

We have very strict security on our servers and they are open only to specific urls. It is possible that this  
server is not open to the /token endpoint. I will check with the systems person.

To verify, is the token endpoint?

https://.[okta.com/oauth2/default/v1/token](http://okta.com/oauth2/default/v1/token)

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 12, 2024, 7:43pm UTC](https://devforum.okta.com/t/passport-authenticate-in-nodejs-hangs/20625/10 "2024-02-12T19:43:58Z")

</div>

Closed on February 12, 2024, 7:43pm UTC