eho/register-referentie
1
0
Fork 0
Code Issues 17 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(portal-self-service): attach the DigiD token to relative BFF calls (refs #68)
All checks were successful
CI / lint (pull_request) Successful in 1m12s
Details
CI / build (pull_request) Successful in 51s
Details
CI / unit (pull_request) Successful in 1m3s
Details
CI / verify-stack (pull_request) Successful in 7m59s
Details
CI / frontend (pull_request) Successful in 1m48s
Details
CI / mutation (pull_request) Successful in 3m57s
Details

Browse Source 
After login the submit silently did nothing: the confirmation ("...is
ontvangen...") never rendered because the POST to the BFF went out with no
Authorization header, so the BFF rejected it and the no-error-handler
subscribe left the page unchanged.

Root cause: angular-auth-oidc-client's interceptor attaches the token when
`req.url.startsWith(secureRoute)`. The api-client calls the BFF with RELATIVE
URLs (same-origin via the nginx proxy), so `req.url` is `/self-service/...` —
but secureRoutes was configured as the app ORIGIN (`http://self-service`),
which a relative URL never starts with. No match → no token.

Configure secureRoutes with the relative `/self-service/` prefix instead. The
unit test mocked the api-client, so only the walking-skeleton e2e exercises the
real token attachment — now green.

Verified against a focused stack (keycloak + self-service + real BFF + stub
domain): the submit now carries the bearer token, the BFF forwards to the
domain, and the portal shows the confirmation with the returned reference.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Niek Otten
2026-07-13 14:09:15 +02:00
parent 39923e0e68
commit 0e6c7d2066
2 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
apps/self-service/src/app/app.config.ts
View File

@@ -14,9 +14,11 @@ export interface RuntimeConfig {
} }
/** /**
* Build the app providers from runtime config. `redirectUrl` and `secureApiOrigin` are the app's own * Build the app providers from runtime config. `redirectUrl` is the app's own origin (where Keycloak
* origin: the app is served same-origin as the BFF (nginx proxies /self-service + /openbaar), so the * redirects back). The app is served same-origin as the BFF (nginx proxies /self-service + /openbaar),
* api-client's relative calls stay same-origin and the token interceptor attaches to them. * so the api-client uses **relative** URLs — hence `secureRoutes` is the relative `/self-service/`
* prefix (the guarded BFF route), not the origin: the interceptor matches on `req.url`, which stays
* relative, so an origin would never match and the token would not be attached.
*/ */
export function appConfig(runtime: RuntimeConfig): ApplicationConfig { export function appConfig(runtime: RuntimeConfig): ApplicationConfig {
const origin = typeof window !== 'undefined' ? window.location.origin : '/'; const origin = typeof window !== 'undefined' ? window.location.origin : '/';
@@ -28,7 +30,7 @@ export function appConfig(runtime: RuntimeConfig): ApplicationConfig {
provideDigiadAuth({ provideDigiadAuth({
authority: runtime.authority, authority: runtime.authority,
redirectUrl: origin, redirectUrl: origin,
secureApiOrigin: origin, secureRoutes: ['/self-service/'],
}), }),
], ],
}; };

11
libs/auth/src/lib/digid-auth.providers.ts
View File

@@ -13,8 +13,13 @@ export interface DigiadAuthOptions {
authority: string; authority: string;
/** Where Keycloak redirects back to after login (usually the app origin). */ /** Where Keycloak redirects back to after login (usually the app origin). */
redirectUrl: string; redirectUrl: string;
/** The BFF origin whose requests get the bearer token attached (secure route). */ /**
secureApiOrigin: string; * Route prefixes whose requests get the bearer token attached. The api-client calls the BFF with
* **relative** URLs (same-origin via the nginx proxy), so these must be relative path prefixes
* (e.g. `/self-service/`) — angular-auth-oidc-client matches `req.url.startsWith(route)`, and a
* relative `req.url` never starts with an absolute origin.
*/
secureRoutes: string[];
} }
/** /**
@@ -35,7 +40,7 @@ export function provideDigiadAuth(options: DigiadAuthOptions): EnvironmentProvid
responseType: 'code', responseType: 'code',
silentRenew: true, silentRenew: true,
useRefreshToken: true, useRefreshToken: true,
secureRoutes: [options.secureApiOrigin], secureRoutes: options.secureRoutes,
logLevel: LogLevel.Warn, logLevel: LogLevel.Warn,
}, },
}, },