SecureRoute does not give protection when used with render

[gabrielmicko]

Hey all,

I am building some components on top of your okta-react. I have found one issue.

When I use the component like this:

<SecureRoute
      render={() => (
        <ApolloProvider>
          <ScreenHome />
        </ApolloProvider>
      )}
    />

It does not run RequireAuth at all. Therefore it will render without any auth checks.

okta-oidc-js/packages/okta-react/src/SecureRoute.js

Line 44 in 28ed8e3

render={ (routeProps) => props.render ? props.render({...routeProps, component: WrappedComponent}) : <WrappedComponent {...routeProps}/> }

I created my SecureComponent where I fixed it like this:

const SecureRoute = ({ component, ...props }: Props) => {
  let PassedComponent = function() {
    return null;
  };

  if (component != null) {
    PassedComponent = component;
  }

  const WrappedComponent = () => (
    <RequireAuth>
      <PassedComponent />
    </RequireAuth>
  );

  return (
    <Route
      {...props}
      render={() =>
        props.render ? (
          <RequireAuth>{props.render({ ...props })}</RequireAuth>
        ) : (
          <WrappedComponent />
        )
      }
    />
  );
};

Version: "@okta/okta-react": "^3.0.1",
Am I missing something?

[gabrielmicko]

Example code:

<SecureRoute
      path="/protected"
      render={() => (
        <div>This is a protected route, and I am not logged in.</div>
      )}
    />

[gabrielmicko]

Example working code:

const SecComp = () => (
 <div>This is a protected route, and I am not logged in.</div>
);
<SecureRoute path="/protected" component={SecComp} />

That redirects me to Okta login.

[tcjcodes]

Having the same problem - this may be a duplicate of #724 that should be fixed in 3.0.2 https://github.com/okta/okta-oidc-js/releases

[entimaniac]

I'm facing this same issue, 3.0.2. Component specified in render of SecureRoute still appear. I can navigate to pages that use component prop instead and I am prompted to login.

[localrobot]

The same is true if using children instead of render / component.

[swiftone]

Internal ref: OKTA-306439

[zg-trinac]

render is still not redirecting to a login in v3.0.2, but component is for me as well

[andrewatduckpin]

Still unable to use render in 3.0.2 and 3.0.3

[swiftone]

Hey folks - this is on my immediate backlog, so while I can't say exactly what day this will be addressed, it should be Real Soon Now ™️