I am trying to build a simple OAuth 2.0 authentication flow for Microsoft/outlook ID. I have tested the flow on localhost everything seems to be working in that.
But when I deploy the APP to Heroku with new Microsoft app credentials and RedirectURI of the Heroku app. It gives H18 error when redirecting to the logincomplete page.
I am able to get the code in the URL, ID_token, and the refresh token.
Relevent information:
Development environment: Nodejs
libraries: simple-oauth2,express,express-session.
Heroku logs
sock=backend at=error code=H18 desc="Server Request Interrupted" method=GET path="/auth/outlook/callback?code=###-###-###-###-###" host=####.herokuapp.com request_id=... fwd="##.##.##.##" dyno=web.1 connect=1ms service=646ms status=503 bytes= protocol=https
Code for redirectUri
app.get('/auth/outlook/callback', async (req, res) => {
const code = req.query.code;
const options = {
code,
redirect_uri: redirectUri,
scope : scopes.join(' ')
};
try {
const result = await oauth2.authorizationCode.getToken(options);
console.log('The resulting token: ', result);
var token = oauth2.accessToken.create({ refresh_token: result.refresh_token, expires_in: 0});
email = authHelper.getEmailFromIdToken(result.id_token);
User.findOne({emailId:email})
.then((existingUser) => {
if(existingUser){
//We already have a new user
}else {
new User({emailId : email}).save();
}
});
req.session.access_token = token;
req.session.refresh_token = token.refresh_token;
req.session.email = email;
console.log(token);
// Check if the token is expired. If expired it is refreshed.
if (token.expired()) {
try {
token = token.refresh();
} catch (error) {
console.log('Error refreshing access token: ', error.message);
}
}
return res.status(200).json().redirect('/logincomplete');
} catch(error) {
console.error('Access Token Error', error.message);
return res.status(500).json('Authentication failed');
}
});
Values of token, email and other variables are set correctly by this code.
Please give suggestions on how to solve this issue.
Also, If you can suggest some passport-strategy package to work with this stuff instead of simple-oauth2. I have tried passport-outlook and passport-Microsoft.
Thanks in Advance.