Fixes custom login callback never finishing the authentication process

[pablote]

This fixes #340 #664 and probably #440 too.

PR Checklist

Please check if your PR fulfills the following requirements:

• [ x] The commit message follows our guidelines
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Adding Tests
• Build related changes
• CI related changes
• Documentation changes
• Other... Please describe:

What is the current behavior?

Currently setting a custom handler for the login callback route, causes the login process to never finish correctly as if it wasn't set.

What is the new behavior?

This fixes it. By switching around the order of, first calling the custom handler, and then the passport middleware to do it's thing.

Does this PR introduce a breaking change?

• Yes
• No

Maybe. The documentation mentions the custom handler to have the (req, res, next) => {} signature, in that sense it didn't changed. But the code used to be able to handle (err, req, res, next) => {} that is no more.

I think this change makes sense, there's no actual error (besides anything you can infer from context) before going through passport and any other handlers. Applications can always register an error handler afterwards in the Express middleware chain, which should be the correct way to go about it.

Other information

Reviewers

[reesewesterhoff]

Any update on whether a fix for this could be merged? Running into the same issue as #340 :

const oidc = new ExpressOIDC({
    issuer: OKTA_ISSUER,
    client_id: OKTA_CLIENT_ID,
    client_secret: OKTA_CLIENT_SECRET,
    appBaseUrl: 'http://localhost:8082',
    scope: 'openid profile',
    routes: {
      loginCallback: {
        handler: (req, res, next) => {
          // console.log('login callback handler hit', req.userContext)
          next()
        }
      }
    }
  })

Without the loginCallback.handler everything works fine, but as soon as I add the loginCallback.handler it gets stuck at the authorization-code/callback?code...&state... url and I get this error in the browser:

[aarongranick-okta]

@reesewesterhoff I have created an internal issue for our engineers to investigate this and provide an update. ref: OKTA-379543

[reesewesterhoff]

@aarongranick-okta thanks for the update! I'll keep on the lookout for any new developments