Identity redirects not working

[kyleschoen]

Okay, I’ve read pretty much every documentation I can get my hands on and I can’t get role based redirects working with my gatsby site with netlify identity (free plan). It seemed to work momentarily on my development URL, but never locally with netlify dev.

Here’s the relevant parts of my .toml file:

[dev]
        targetPort = 8000 # The port for your application server, framework or site generator
        port = 8888 # The port that the netlify dev will be accessible on
        jwtRolePath = "app_metadata.roles"

[[redirects]]
        from = "/dashboard/*"
        to = "/dashboard/:splat"
        force = true
        status = 200
        conditions = {Role = ["registered_user"]}

[[redirects]]
        from = "/dashboard/*"
        to = "/login"
        status = 200
        force = true

Here’s the JWT user info:

app_metadata: 
    provider: "email"
    roles: Array(1)
        0: "registered_user"
        length: 1

I’ve also tried jwtRolePath = “app_metadata.authorization.roles” as stated in the documentation.

It always redirects to the login page regardless of if the user is authenticated of not. The desired functionality is to not change the URL they are on if it’s /dashboard or deeper, redirect to /login if they are not authenticated.

Any help is very appreciated!

[kyleschoen]

Update: seems like it works on a live staging branch but after some time it redirects like I’m logged out even though I’m not. Almost like the session has expired or something.

For local development, the redirects seem to not capture the role at all, and therefore doesn’t work at all.

[SamO]

Hi @kyleschoen unfortunately we can’t help with your code not working locally as this is outside the scope of support. . Below is some documentation on our redirects.I strongly suggest you give it a thorough read through and see if this fixes your problem:

[Support Guide] Making redirects work for you - troubleshooting and debugging

Last checked by Netlify Support Team: September 2023. Introduction You’ve put blood, sweat and tears into building an incredible static site with all the bells and whistles. However, you’ve configured some redirect rules and you’ve come unstuck… they don’t appear to be working! Ensure you’ve followed the correct guidance Our redirects and rewrites document covers a broad range of use cases, from status codes to proxying another service and everything in between. Ensure you’re using the correc…

I’ll leave your thread open for those who can assist.

If you do get this working locally and still have a non-code related issue I am happy to help.

[jasiqli]

@kyleschoen

Almost like the session has expired or something.

That is precisely because the session does and will expire. This refresh is usually handle by the identity widget—but only when the page is active.

There a numerous posts regarding identity and token refresh such as

Role Based Redirects causing an infinite loop

Currently have a role-based redirect on my deployed site to gate content and redirect visitors to the login page. Unfortunately, I’m unable to share the project but I will show the redirect rules and functions I have applied on the instance - _redirects: # Always allow /login /login 200 /docs/icons/hero.svg /docs/icons/hero.svg 200 /templates/* /templates/* 200 # If a `basic-user` serve page /* 200! Role=authorized # Other send to login /* /login 302! scripts used…

Token doesn't work after netlifyIdentity.refresh() until page reload

I am using netlify identity widget for content protection. Issue is that after 1h access token expires which can be refreshed by built-in method like netlifyIdentity.refresh().then(token => console.log(token)) But issue is that it doesn’t work until page is reloaded which is not expected behavior for user. User open page and if token expires page will reload again to apply refreshed token.

[kyleschoen]

Thanks for the insight — I have gone through that doc and tried every combination possible, but it’s something strange with the local dev possibly not being able to pick up the Role condition. I’ve given up on this approach and am building out routing in Gatsby which seems to be working very well now.

[kyleschoen]

Really appreciate the token expiration links here. This part still confuses me despite moving to Gatsby routing instead of role based redirects.

As a workaround, I’m currently checking for the goTrue cookie which persists after it’s expiration time. Do you see any issue with this route?

[jasiqli]

If you are checking for a locally stored cookie, do ensure there are some checks (out of site of the user) to check the validity of that cookie and any other stored cookies/data.

You might find this video from Egghead useful

Using Netlify Identity to control access to a Gatsby client-side dashboard route

[kyleschoen]

Some great info in there, thanks!

For some reason calling netlifyIdentity.currentUser() is working now instead of checking local storage. I also found a link in another forum about how to handle the expiration through the goTrue JS source code: gotrue-js/user.js at main · netlify/gotrue-js · GitHub

Looks like a similar function could compare when the token was created against a custom expiration limit and then force the user to log in again. Posting here in case anyone else is looking for a similar answer.

[hrishikesh]

Netlify Identity does not work with CLI: [feature] local emulation of Netlify Identity · Issue #440 · netlify/cli · GitHub, at least not till you provide your own JWT secret. To keep the secret consistent with CLI and production, you’d have to be on the Business plan that allows setting a custom JWT secret.