Secured nodejs backend API's using keycloak

Question

I'm implementing a Nodejs backend API's. Some of them are need to authenticate before access. for that I choose keycloak server as identity server. I used npm keycloak-connect library to integrate node server and the keycloak server. Now the authentication are woking fine.

problem is when I logout from keycloak server by using 'http://localhost:8080/auth/realms/test-realm/protocol/openid-connect/logout' this API. keycloak server says token is not valid anymore. But when I used the same taken to access Node server it takes that token as valid token.

'use strict';

const Keycloak = require('keycloak-connect');
const express = require('express');
var cors = require('cors')
const app = express();

app.use(cors())


var keycloakConfig ={
  "realm": "test-realm",
  "auth-server-url": "http://localhost:8080/auth",
  "ssl-required": "external",
  "resource": "test-dev-api",
  "public-client": true,
  "confidential-port": 0
}

var keycloak = new Keycloak({},keycloakConfig);

app.use( keycloak.middleware( { logout: '/logout'} ));

app.get('/secured-echo', keycloak.protect(), function(req,resp) {
  resp.send("Secured Hello");
});

//unprotected route
app.get('/echo', function(req,resp) {
  console.log(keycloakConfig)
  console.log(keycloak)
  resp.json({"say": "hello"});
});

app.listen(4000, function () {
  console.log('Listening at port:4000');
});

Robin Robin · Accepted Answer · 2019-12-01T13:23:26

Your application uses Express, which maintains its own sessions and synchronizes those with Keycloak tokens. So logging out on Keycloak does not tell Express that you have logged out. Subsequently you can still log in to your application.

In your code you have specified this:

app.use( keycloak.middleware( { logout: '/logout'} ));

Which is the URL on your application to logout in your Express application. Use that instead of directly logging out of Keycloak. The keycloak middleware will then log out in Keycloak. It will be something like

http://localhost:4000/logout

Secured nodejs backend API's using keycloak

2 Answers