#732·passport

Passport.authentication() hangs

Author: jandraorCreated May 28, 2019Updated Jun 11, 2025

I implemented Facebook, LinkedIn & Google strategies in an Express/node app using Oauth 2.0.

It works fine on fast connections (Ethernet cable & 4G mobile) . However, in a slow connection (such as wi-fi) it keeps hanging after receiving the authorization code.

The server log shows GET /auth/facebook 302 & nothing else happens.

When it works, it fires the callback route "/auth/facebook/callback".

This is the url on the browser:

https://www.mywebsite.com/auth/facebook/callback?code=AQA7wUUnGkpsdFVs-PggQIbd809iOQ_B57oTSoKWmOe0JH9dsu4DI12IPP9Rr2jdVhSsWNexbhCy_Euy9pD0NGliY_zMEN3VPdRkiA4pnkeDLJyqWluuMxg4-khWagrKidgIK0GQW7-0MHkrCEyMvAnAucyNB5fnc2J2_byLSB6ELrfsBe-52jA4eLR6RFIshdLlO9qxTJmGH0JGU74a5zTNET9S52PaCUk6wEZD35Wl9zCLb5aaklOMiGm8JyW2KuoZnYkNYCEW6Yggr35eokXsMeJwqp_q2_qP4RQv82dhL47ZRX_da4MOPDPkyYTA4dc#=

It shows the error "Connection timed out".

I could trace where the flow gets stuck.

router.get('/facebook', passport.authenticate('facebook', { scope : ['email'] }));

Debuggin passport code I found that this is the last code block executed (file authenticate.js) when the flow stops.

  strategy.redirect = function(url, status) {
        // NOTE: Do not use `res.redirect` from Express, because it can't decide
        //       what it wants.
        //
        //       Express 2.x: res.redirect(url, status)
        //       Express 3.x: res.redirect(status, url) -OR- res.redirect(url, status)
        //         - as of 3.14.0, deprecated warnings are issued if res.redirect(url, status)
        //           is used
        //       Express 4.x: res.redirect(status, url)
        //         - all versions (as of 4.8.7) continue to accept res.redirect(url, status)
        //           but issue deprecated versions
        
        res.statusCode = status || 302;
        res.setHeader('Location', url);
        res.setHeader('Content-Length', '0');
        res.end();
      };

I performed login on google with a mobile using two different connections (Mobile 4G & wifi). It works on the Mobile 4G and fails on the wifi. I printed res.req.headers before res.end, and these are the results

// When it works

{ host: 'mywebsite.com:60900', connection: 'keep-alive', 'upgrade-insecure-requests': '1', 'save-data': 'on', 'user-agent': 'Mozilla/5.0 (Linux; Android 8.0.0; XT1635-02) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36', accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3', referer: 'https://mywebsite.com:60900', 'accept-enconding': 'gzip, deflate, br', 'accept-language': 'en-GB,en;q=0.9,en-US;q=0.8,es;q=0.7', cookie: 'connect.sid=s%3APk6cDtP8eFK2EHlQna68DmTDEaRLoTo4.BLnv%2F20SzBlP%2F9HFfD2wTw8WwqVgbSqYJEVauJ3zsel' }

//When it does not work

{ host: '127.0.0.1:60900', connection: 'close', 'upgrade-insecure-requests': '1', 'save-data': 'on', 'user-agent': 'Mozilla/5.0 (Linux; Android 8.0.0; XT1635-02) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36', accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3', 'accept-enconding': 'gzip, deflate, br', 'accept-language': 'en-GB,en;q=0.9,en-US;q=0.8,es;q=0.7', cookie: 'connect.sid=s%3APk6cDtP8eFK2EHlQna68DmTDEaRLoTo4.BLnv%2F20SzBlP%2F9HFfD2wTw8WwqVgbSqYJEVauJ3zsel' }