Okta authentication go into looping

[limwtn]

I am using the below version combination for my nodejs app and it is going into looping when performing authentication.:
"@node-saml/passport-saml": "^5.1.0",
"body-parser": "^2.2.0",
"express": "^5.1.0"

It only works when i changed to use body-parser v 1.20.3.

Any suggestion?

Thank you

[markstos]

Can you describe the loop in more detail? What's in the error logs during the loop? Is it a redirect loop? What are the URLs involved?

Looking at the body-parser changelog between v1 and v2, what breaking changes do you see that might be related?

[markstos]

Are there errors in the logs when this happens? Where this URL redirecting to that's redirecting back to it?

Looking at the body-parser changelog between v1 and v2, what breaking changes do you see that might be related?

[limwtn]

Hi, i added some logging . Seem like the looping happened when calling "passport.authenticate". It will POST the call back to app.post itself again and again............
app.post("/api/auth/callback",
(req, res, next) => {
console.log("🚀 Incoming request to /api/auth/callback");
next();
},
bodyParser.urlencoded({ extended: false }),

(req, res, next) => {
    console.log(" After Parsed body:");
    next();
},    
passport.authenticate("saml", { failureRedirect: "/api/auth/login-fail", session: false }),
(req, res) => {

[markstos]

In your local copy, add more debug logging to passport-saml authenticate method to understand why it's POST'ing back to the same URL.

[markstos]

Looks like the issue was resolved over here: #128 (comment)

The solution is that body-parser is not required with Express 5.

[limwtn]

Hi, sorry for getting back late.

Seem like the issue is in bodyParser.urlencoded({ extended: false });

I have replaced the below 2 line to use my own method, then it work;

// ================= Removed ============================
bodyParser.urlencoded({ extended: false }), // version 2.2.0 doesn't work here
passport.authenticate("saml", { failureRedirect: "/api/auth/login-fail", session: false }),
// ============================================

        // 1️⃣ Convert raw buffer to string
        const rawBody = req.body.toString("utf8");

        // 2️⃣ Parse it as querystring (urlencoded form)
        const SAMLResponse = querystring.parse(rawBody);

       const decodedXml = Buffer.from(SAMLResponse , "base64").toString("utf8");

After which, i extract the needed info from the XML.