/user/redirect
The module exports the default redirect method called from the default or a custom user authentication method.
- Source
Requires
- module:jsonwebtoken
- module:/user/acl
Methods
(inner) redirect(req, res, user)
A user object from the acl module is performed with the lookup property flag in the provided user param.
A user cookie is signed with the jsonwebtoken library and set on the response header.
The method checks for a redirect location on the user object or a _redirect cookie and sets the location header to the redirect location or the base directory if no redirect target is found.
The redirect cookie is destroyed [set to NULL] with the response header.
The response is sent with a 302 status code to redirect the client to the location header URL.
| Name | Type | Description |
|---|---|---|
req | req | HTTP request. |
res | res | HTTP response. |
user | object | The user object should contain an email property and optionally a lookup property which will trigger a lookup in the ACL for the user email to assign any additional properties from the ACL to the user object before signing the cookie. |
| Name | Type | Attributes | Description |
|---|---|---|---|
user.email | string | The email property is required to lookup the user in the ACL and assign any additional properties to the user object before signing the cookie. | |
user.lookup | boolean | <optional> | The lookup property flag will trigger a lookup in the ACL for the user email to assign any additional properties to the user object before signing the cookie. |
user.redirect | string | <optional> | Redirect target provided by an authentication flow such as SAML RelayState. |
- Source
(inner) trustedReturnOrigin(location) → {boolean}
Checks whether an absolute redirect location's origin is present in the comma-separated TRUSTED_RETURN_HOSTS xyzEnvironment variable.
An absolute redirect target needs an explicit host allowlist rather than a broadened blanket rule, so this returns false whenever TRUSTED_RETURN_HOSTS is not configured.
| Name | Type | Description |
|---|---|---|
location | string | Absolute URL to check. |
- Source
Whether the location's origin is in the trusted host allowlist.
- Type:
- boolean