Darkscribes Community

Thank you, @julian. I followed the same login process — after logging in with Google through Cognito, I call the NodeBB login API.

I am using AWS Cognito with React.js on the frontend for registration and login. If a user logs in successfully, I call the NodeBB login or register API from the backend. Now, I want to add Google login with NodeBB.

Ok Thank you again @julian

@julian Thank you for the clarification.

I am using React.js for my frontend, and the NodeBB forum is just one module inside my overall project.

I understand now that I can use the master token + ?_uid= approach to call the NodeBB APIs directly, and maintain my own mapping between the Cognito sub and the NodeBB uid.

I was initially looking at the session-sharing plugin, but since I am not using the NodeBB frontend at all, I think the create-user API + master token flow might be a cleaner solution for me.

Could you please confirm if in my case hitting the create-user API and maintaining the mapping is better than trying to wire up session-sharing?

Hi community,

I’m using AWS Cognito for authentication (sign up and login) across my project, and all user management is centralized there.

Now I want to integrate NodeBB, but I do not want to use NodeBB’s UI for login/registration. Instead, I want to:

• Continue using AWS Cognito for user registration and login.

• Expose a common backend service (API) that my other modules (and NodeBB) can use for authentication.

• Use only the NodeBB APIs (not the UI) to handle sessions, topics, posts, etc.

I’m a bit unsure about the correct approach here:

• Can NodeBB rely fully on Cognito for authentication while I interact with NodeBB only through its APIs?

• How should I map Cognito users to NodeBB users (e.g., using Cognito’s sub as the NodeBB uid)?

• Should I use the session-sharing plugin, or is it better to build a custom integration for Cognito?

• What’s the recommended way to keep NodeBB users in sync with Cognito users if I bypass the UI?

Has anyone implemented this kind of API-only integration with Cognito and NodeBB? Any best practices or guidance would be much appreciated.

Thanks!

Hi @julian, thank you for your previous reply, and sorry for the late response.

I was able to resolve the CORS issue using Nginx. Now, I’m working on integrating the NodeBB Write API with my React.js frontend. For authentication, I’m using Keycloak for login and registration.

I have a question regarding the express.sid cookie:

After login, the express.sid is generated and stored in the cookies.

I tried using this session ID to fetch the CSRF token by calling /api/config, but it doesn’t seem to work for me.

My goal is:

Successfully retrieve a valid CSRF token.

Use it to create topics or posts via the Write API.

Ensure that once I have this token and session, I can access all the required NodeBB APIs.

Could you please clarify the correct approach to:

Retrieve and use the CSRF token with the express.sid?

Authenticate API requests (like creating topics or posts) when using Keycloak for login instead of NodeBB’s built-in login?

Any guidance or best practices for this integration would be greatly appreciated.

Thanks in advance!

Hi NodeBB team,

I have NodeBB running locally on my machine:

NodeBB version: v3.12.7

Environment: Local development

Frontend: React (Vite) running on http://localhost:5173

Backend (NodeBB) running on http://localhost:4567

I’m trying to create a user via the API:

async function registerUser() {
  try {
    const res = await fetch(`${import.meta.env.VITE_API_URL}v3/users`, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "Authorization": `Bearer ${import.meta.env.VITE_TOKEN}`
      },
      body: JSON.stringify(formData),
    });

    if (!res.ok) {
      throw new Error(`HTTP error! Status: ${res.status}`);
    }

    const data = await res.json();
    console.log("User registered successfully:", data);
  } catch (error) {
    console.error("Error registering user:", error);
  }
}

Question:
How can I correctly configure NodeBB in development so that it allows the Authorization header in API requests?
Even after setting Access-Control-Allow-Headers in the ACP, the browser still fails at the preflight request.
Do I need a plugin or middleware to handle CORS for API v3 routes?