Reverse Proxy login with credentials from node.js

Question

I currently have a server running Spring in a Tomcat servlet with Shiro Token system for checking if a user is logged in already. It allows cross-domain requests.

In any other domain I can on the client (generally using angular) call...

http.get('https://<my_check_login_service>', {withCredentials: true})

...and as long as I am already logged in (token doesn't expire) return the user info (name, avatar, etc.).

I have another system now that is a node server (also serving up angular for the client side) for which I would like to call the node server and have it proxy over to the above my_check_login_service to get the user, set info on the session object (using express), and then return the user to the client. But also, through the session object, allow me to trust their connection and allow them to perform further api calls depending on the security level of the user returned from the login service.

On the node.js router I can proxy doing this ...

app.get('/checklogin', function(req, res) {
    req.pipe(request.get("https://<my_check_login_service>").pipe(res);
}

...but I don't know how to pass the proper credentials to the service. If I do ...

http.get('checkLogin', {withCredentials: true})

...it, of course, doesn't work because the credentials for my login_service are not sent to the local server. How can I pass the correct credentials to make this work?

Cheers.

Answer 1

Credentials are most likely in the HTTP headers, passing all headers (both from request and to response), with the address of original request, should make it work:

app.get('/checklogin', function(req, res) {
  console.dir(req.headers)
  //You can inspect the headers here and pass only required values
  const options = {
    url: 'https://<my_check_login_service>',
    headers: Object.assign(
      //Tell the login service about address of original request
      {'X-Forwarded-For': req.connection.remoteAddress}
      req.headers)
  }
  req.pipe(request.get(options))
  .on('response', (response) => res.set(response.headers))
  .pipe(res)
}

This example passes original address by setting X-Forwarded-For, login_service may recognize it ...or not, depending on the configuration.