node.jsiiswindows-serveriisnodepassport-windowsauth

IIS keep prompting Windows Credentials on 401 with IISNode


I'm hosting a web application built with NestJs and React (NodeJs) in an IIS Server with IIS Node. To secure my app, I'm using a system with JWT Token + Refresh Token and Windows Authentication to automatically get the connected user and so generate tokens.

Everything (almost) is working fine, but I have a problem with the Windows Authentification. Each time the JWT Token of my application expired (so the API returns a 401 error page) and only after a refresh of the navigator page, the navigator prompt again the pop up to set windows credentials. The logic use case on this is that one day you're using the webapp, and some days later you want to use the app again, but your token is expired, 401 error, windows credentials is prompting.

If the token expires, and the user simply navigate to another page (so no page refresh with my React SPA) there's no problem, the JWT token is refreshed with the refresh token thanks to the API.

I've already tried some stuff:

But I haven't found a solution yet.

My goal is to only have the Windows Credentials display once, when the user visits the page for the first time.

As I'm out of ideas, I'm considering setting a JWT that never expire, but of course it's not a great solution.

Thank you very much for your help!


Solution

  • I ended up using a custom 4xx code to handle my 401. So if my API is sending me a 499 http, I know it mean for my frontend that the session is expired. Hence, I don't have the prompt for Windows Credentials.