Can't pass req session vars to callback

[0xKawaka]

Hi,
I'm trying to pass redirectUrl to the req.session but it's undefined in the callback. Is this expected behavior?

app.get('/auth/twitter', (req, res, next) => {
  const redirectUrl = req.query.redirectUrl || envVars.ORIGIN;
  req.session.redirectUrl = redirectUrl;

  passport.authenticate('twitter', {
    scope: ['tweet.read', 'users.read', 'offline.access'],
  })(req, res, next);
});

app.get('/auth/twitter/callback',
  passport.authenticate('twitter', { failureRedirect: '/login-failure' }),
  (req, res) => {
    console.log('req.session.redirectUrl:', req.session.redirectUrl);
  }
);

Added passReqToCallback to the strategy options but didn't fix it.

{
      clientID: envVars.TWITTER_CLIENT_ID,
      clientSecret: envVars.TWITTER_CLIENT_SECRET,
      clientType: 'confidential',
      callbackURL: envVars.CALLBACK_URL,
      passReqToCallback: true,
},

[janhalama]

Hi, you should use state to store redirect url instead of using directly the session. It is recommended by Jared Hanson in his article on state handling in OAuth flows. For further details refer to Jared Hanson's article.

Jan