Passing query params makes requests bypass the auth check about adminjs-expressjs HOT 8 CLOSED

I'll try to fix this ASAP (probably tomorrow). If this is critical for you, you can in the meantime create an express middleware to protect your admin router

from adminjs-expressjs.

Everything seems to be working correctly now.

Thank you for the fix. And thank you for this project.

from adminjs-expressjs.

You're welcome. Just leaving one extra note for if you want to extend AdminJS router with extra endpoints in the future.

Currently, if you added a custom endpoint, the middleware would return a redirect to the loginPath. If you want to add custom routes, you might have to modify your setup a bit. In my case I have a /refresh endpoint for refreshing a session with external API service. In order to make it work but also have access to user's session I have to create express router manually and pass it to buildAuthenticatedRouter:

  const ConnectSession = ConnectPgSimple(session);

  const sessionStore = new ConnectSession({
    conObject: {
      database: config.db.database,
      host: config.db.host,
      port: config.db.port,
      user: config.db.username,
      password: config.db.password,
      ssl: config.db.ssl,
    },
    tableName: 'session',
  });

  const sessionOptions = {
    store: sessionStore,
    cookie: {
      httpOnly: config.session.httpOnly,
      secure: config.session.secure,
    },
    saveUninitialized: config.session.saveUninitialized,
    resave: config.session.resave,
    unset: config.session.unset,
    secret: config.session.cookiePassword,
    name: config.session.cookieName,
  };

  const router = express.Router();
  router.use(session(sessionOptions));
  router.get('/refresh', refresh);

  AdminJSExpress.buildAuthenticatedRouter(adminJs as any, {
    cookieName: config.session.cookieName,
    cookiePassword: config.session.cookiePassword,
    authenticate,
  }, router, sessionOptions);

  app.use(adminOptions.rootPath ?? '/admin', router);

from adminjs-expressjs.

I am not sure if I am doing something wrong, but I have updated to 4.1.1 and now applying any query param via UI (sort or filter by field) throws this alert and logs me out.

Must be a regression from #81 .

from adminjs-expressjs.

@dklymenk can you show how your url is structured? I've just retested and http://localhost:3000/resources/cases?filters.sex=male&page=1 works for me

from adminjs-expressjs.

Example URL I get when clicking on description field: http://localhost:3000/admin/resources/Report?direction=asc&sortBy=description
Example URL I get when applying a filter: http://localhost:3000/admin/resources/Report?filters.status=UPLOADED&page=1

from adminjs-expressjs.

Yeah, it seems not to be the case if set rootPath to /. Only when I set it back to /admin I get this behaviour.

from adminjs-expressjs.

I've just released another version and added an additional unit test for a different root path, can you take a look?

from adminjs-expressjs.