Trying to authenticate my entire remix app using OAuth2

[Will-Mann-16]

Hi there, I'm trying to authenticate my entire remix app using a custom OAuth2 strategy I wrote - my question is, can I set it up so that the entire app requires authentication apart from a preset callback / failure endpoint? Anyone tried anything like this? I've been trying to figure out how remix's routing situation works here.

[mcgaw]

I've looked at doing this as well. Unbelievably, Remix doesn't easily support having authentication in a single location. I'll investigate the Express adapter, since I'm using Nodejs, and also the concept of using wrapped loader and action functions.

[mcgaw]

If you're using Nodejs, I recommend just using remix-express and Passport.

[sergiodxa]

Until Remix adds support for middleware, there's no way to setup auth in a single point and protect all routes, so you need to add the call to isAuthenticated in every route where you need to know if the user is authenticated or not.

[mcgaw]

This is incorrect, at least if you are using Nodejs. If you use create-remix and choose "Express Server", then you are presented with a server.js file in the project root, which is the server entry point and where various Express middlewares are setup. I removed the remix-auth and remix-auth-okta code (I'm using Okta) and in server.js added Passport middlewares which use the oidc strategy, using this very helpful guide (which is ironically better than the Passport documentation).
Now all routes are sanely protected, and all the security code is tucked away in server.js.

[manzaloros]

@mcgaw , do you have an example of this authentication using Express middlewares?

[mcgaw]

Hi, I've not used Remix for a while but there's a basic example here. I've modified server.js to secure all the Remix routes and passed the user through when authenticated. I guess some kind of authentication proxy is also an answer.