{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/express/issues/2549","labels_url":"https://api.github.com/repos/strongloop/express/issues/2549/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/express/issues/2549/comments","events_url":"https://api.github.com/repos/strongloop/express/issues/2549/events","html_url":"https://github.com/strongloop/express/issues/2549","id":57759117,"number":2549,"title":"Unexpected (incorrect?) behaviour difference between `route.all` and `route.get` methods","user":{"login":"rhys-vdw","id":822105,"avatar_url":"https://avatars.githubusercontent.com/u/822105?v=3","gravatar_id":"","url":"https://api.github.com/users/rhys-vdw","html_url":"https://github.com/rhys-vdw","followers_url":"https://api.github.com/users/rhys-vdw/followers","following_url":"https://api.github.com/users/rhys-vdw/following{/other_user}","gists_url":"https://api.github.com/users/rhys-vdw/gists{/gist_id}","starred_url":"https://api.github.com/users/rhys-vdw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhys-vdw/subscriptions","organizations_url":"https://api.github.com/users/rhys-vdw/orgs","repos_url":"https://api.github.com/users/rhys-vdw/repos","events_url":"https://api.github.com/users/rhys-vdw/events{/privacy}","received_events_url":"https://api.github.com/users/rhys-vdw/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/express/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-02-16T02:34:13Z","updated_at":"2015-02-16T03:13:59Z","closed_at":null,"body":"Hi, this is a bit complex, but I assume it boils down to a misunderstanding of the API.\r\n\r\nMy routing is set up like this:\r\n\r\n\r\n`app.coffee`\r\n```coffeescript\r\nrouter = require 'router'\r\n# ...\r\npassport.use User.createStrategy()\r\npassport.serializeUser User.serializeUser()\r\npassport.deserializeUser User.deserializeUser()\r\n\r\napp = express()\r\n\r\napp.use bodyParser.json()\r\napp.use cookieParser()\r\napp.use session\r\n  secret: '----'\r\n  key: '---'\r\n  cookie:\r\n    maxAge: moment.duration(30, 'days').asMilliseconds()\r\n  saveUninitialized: true\r\n  resave: true\r\napp.use passport.initialize()\r\napp.use passport.session()\r\napp.use router\r\n```\r\n\r\n`router.coffee`\r\n```coffee\r\nclientsRouter = require 'clients-router'\r\nrouter = express.Router()\r\n# ...\r\nrouter.use '/clients', clientsRouter\r\n# ...\r\nmodule.exports = router\r\n```\r\n\r\n`clients-router.coffee`\r\n```\r\n\r\nclientsRouter = express.Router()\r\n\r\nclientsRouter.route '/'\r\n.all   User.administratorOnly()\r\n.get   pex.send (req) -> Client.fetchAll()\r\n.post  pex.send (req) -> Client.forge(req.body).save()\r\n\r\nmodule.exports = clientsRouter\r\n```\r\n\r\nSo, routers twice nested. The problem here is that `User.administratorOnly()` is called **before** `passport.session()`. So I get a 401 from my `administratorOnly` call when I hit this route.\r\n\r\nEverything is okay, however, if I move the check into the method specific middleware like this:\r\n\r\n```\r\nclientsRouter.route '/'\r\n.get   User.administratorOnly(), pex.send (req) -> Client.fetchAll()\r\n.post  User.administratorOnly(), pex.send (req) -> Client.forge(req.body).save()\r\n```\r\n\r\nI'd have assumed that the 'all' middleware would be fired immediately before `get`. But I can see (from logs) that `administratorOnly` is being called **before** Passport's `deserializeUser` function. (Therefore there is no access to the `req.user` object). Is this a bug?\r\n\r\n(PS. Sorry for CoffeeScript, also `pex.send` just returns a middleware that wraps a promise.)"},"comment":{"url":"https://api.github.com/repos/strongloop/express/issues/comments/74454919","html_url":"https://github.com/strongloop/express/issues/2549#issuecomment-74454919","issue_url":"https://api.github.com/repos/strongloop/express/issues/2549","id":74454919,"user":{"login":"rhys-vdw","id":822105,"avatar_url":"https://avatars.githubusercontent.com/u/822105?v=3","gravatar_id":"","url":"https://api.github.com/users/rhys-vdw","html_url":"https://github.com/rhys-vdw","followers_url":"https://api.github.com/users/rhys-vdw/followers","following_url":"https://api.github.com/users/rhys-vdw/following{/other_user}","gists_url":"https://api.github.com/users/rhys-vdw/gists{/gist_id}","starred_url":"https://api.github.com/users/rhys-vdw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhys-vdw/subscriptions","organizations_url":"https://api.github.com/users/rhys-vdw/orgs","repos_url":"https://api.github.com/users/rhys-vdw/repos","events_url":"https://api.github.com/users/rhys-vdw/events{/privacy}","received_events_url":"https://api.github.com/users/rhys-vdw/received_events","type":"User","site_admin":false},"created_at":"2015-02-16T03:13:59Z","updated_at":"2015-02-16T03:13:59Z","body":"Okay, sorry. Yes, that was a typo (corrected now).\r\n\r\n`deserializeUser` is a side effect of passport.session(). This is what I expect to happen on ` /clients/` GET:\r\n\r\n 1. Request is received with cookie data.\r\n 2. `passport.session()` creates `req.user`\r\n 3. `router` re-routes `/clients` to `clientsRouter`\r\n 4. `clientsRouter`'s `.route('/').all` middleware is executed, checking `req.user`\r\n 5. Then move to `.route('/').get`\r\n 6. Successfully return collection.\r\n\r\nThe problem is that step `router.route('/').all` is being called before the middleware specified in `app.use`\r\n\r\nI will try to reduce this problem down a simple example, I was just hoping there something obvious I was missing."}}