zemirco / lockit-login Goto Github PK

I just recently upgraded to node 8.4 and ran into the following error ...
"Unhandled rejection TypeError: The "digest" argument is required and must not be undefined"
The problem seems to original from the couch-pwd package which is calling the crypto.pbkdf2 missing the first parameter. The most recent version of couch-pwd seems to have fixed this, but it has not been published to npm yet :(
zemirco/couch-pwd#2

Here sessions are destroyed with req.session = null. Although this works for sessions stored in memory, sessions stored in a database (a session store) simply restore the session from the database if it is missing. To effectively destroy sessions stored in a database, I believe you should use req.session.destroy(). See http://expressjs-book.com/forums/topic/express-js-sessions-a-detailed-tutorial/ (look for "Deleting a Session Store-based Session").

If we send the http request:

GET /login?redirect=%2Foauth2%2Fauth%3Fresponse_type%3Dcode%26client_id%3Dcli

We will get a login page with a form, the action of the form is:

/login?redirect=/oauth2/auth?response_type=code&client_id=cli

This is incorrect as we will post to /login with wrong query strings. The correct url should be the same with the GET one.

It caused by line 80 in lockit-login/index.js:

var suffix = req.query.redirect ? '?redirect=' + req.query.redirect : '';