I have followed the tutorials to build an Azure AD B2C protected WebAPI. I have a JS client app that requests an id token
and then an access token
. This works fine.
Now I want to protect my socket.io API using the same method. I can send the access token acquired by the JS client app with each socketio request to the API.
And this is where my problems begin, because on the API end the recommended method is to use passport, which directly plugs into the express server as a middleware.
But what I would like is to just call a function with the token that I received from the client to verify it:
function init() {
// setup the Azure AD B2C
const bearerStrategy = new BearerStrategy(msalconfig,
function (token, done) {
// Send user info using the second argument
done(null, {}, token);
}
);
// what else is needed in this case?
...
this.socketNamespace.use(authSockForGroup)
}
// this is called on each socketio request
export function authSockForGroup(socket: Socket, next: (err?: any) => any) {
// extract the token
const token = socket.handshake.query['token']
// verify Azure AD B2C token
if (!passport.verifyToken(token)) // I would need something like this
{
// verification of the Azure AD B2C access token failed
next(new HttpError(HttpStatusCodes.Forbidden))
}
}