access-token provided but disappears

[dekz]

Hi Lynn,

I'm library some strange issues with using the library, in conjunction with the devise_token_auth.

From what I can see in Postman, the headers are being returned:

I can confirm this in the Chrome dev tools network as well:

But nothing is written to Local Storage, or the Cookies if I try that method. I added an interceptor and it seems to return undefined for the header as well.

.config(function($authProvider, $httpProvider) {
  $httpProvider.interceptors.push(function($q, $injector)  {
    return {
     'request': function(config) {
       return config || $q.when(config)
      },

      'response': function (response, $auth) {
        console.log('interceptor response', response)
        console.log('interceptor response', response.headers('access-token'))
        return response || $q.when(response);
      }
    };
  });

I am even trying a special handleLoginResponse:

      handleLoginResponse: function(response, $auth) {
        console.log("response");
        console.log(response);
        $auth.persistData('auth_headers', {

          // save the token
          'Authorization': 'Bearer ' + response['access_token'],

          // convert the expiry value into a date that this module understands
          'expiry': new Date().getTime() + response['expires_in']
        });
        return response.data;
      },

I get a 200 with a serialized user model (no auth_token in the serialized user model) when I sign in, just something weird happens in between!

[dekz]

That Access-Expose-Headers looks suspiciously empty... My CORS in Rails is:

    config.middleware.insert_before 0, "Rack::Cors" do
      allow do
        origins '*'
        resource '*',
          :headers => :any,
          :expose  => ['access-token', 'expiry', 'token-type', 'uid', 'client'],
          :methods => [:get, :post, :options, :delete, :put]
      end
    end

[dekz]

Sorry mate this was totally an issue with me, for some reason the expose isn't working in CORS with that code.

    config.action_dispatch.default_headers = {
      'Access-Control-Expose-Headers' => ['access-token', 'expiry', 'token-type', 'uid', 'client'].join(',')
    }

That forces it to happen without the CORS gem.