Skip to content

Commit 152fad6

Browse files
author
Eiman Eltigani
committed
clean up comments
1 parent 4b2fb16 commit 152fad6

2 files changed

Lines changed: 43 additions & 32 deletions

File tree

‎web-integrations/javascript-sdk/server-side-node/README.md‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,14 @@ The following table lists the environment variables that you must specify to sta
6464
| `UID_CSTG_SERVER_PUBLIC_KEY` | Your UID2/EUID server public key for Client-Side Token Generation. **These are public credentials.** | Your assigned public key |
6565
| `SESSION_KEY` | Used by the cookie-session middleware to encrypt the session data stored in cookies. | Any secure random string |
6666

67-
> **⚠️ Important**: Your CSTG subscription must be configured with `http://localhost:3034` as an allowed origin. Contact your UID2/EUID representative to add this origin to your subscription's allowed origins list.
67+
### Optional Configuration
68+
69+
| Variable | Description | Example Values |
70+
|:---------|:------------|:---------------|
71+
| `UID_CSTG_ORIGIN` | The public URL where this application is deployed. Must match your CSTG subscription's allowed origins. Defaults to `http://localhost:PORT`. | `https://your-domain.com` (production)<br/>`http://localhost:3034` (default) |
72+
| `PORT` | Port number for the server | `3034` (default) |
73+
74+
> **⚠️ Important**: Your CSTG subscription must be configured with an allowed origin that matches where your application is deployed. For production deployments, set `UID_CSTG_ORIGIN` to your application's public URL (e.g., `https://your-domain.com`). For local development, it automatically defaults to `http://localhost:PORT`.
6875
6976
### Display/UI Configuration
7077

‎web-integrations/javascript-sdk/server-side-node/server.js‎

Lines changed: 35 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,52 @@
11
"use strict";
22

3-
// Load environment variables from .env file (for local development)
3+
// Load environment variables
44
require('dotenv').config({ path: '../../../.env' });
55

66
const session = require('cookie-session');
77
const ejs = require('ejs');
88
const express = require('express');
9-
const nocache = require('nocache');
10-
const { JSDOM } = require('jsdom');
119
const crypto = require('crypto');
12-
const util = require('util');
13-
const XMLHttpRequest = require('xhr2');
10+
const nocache = require('nocache');
11+
1412

1513
const app = express();
1614
const port = process.env.PORT || 3034;
1715

1816
let uidBaseUrl = process.env.UID_SERVER_BASE_URL;
1917
const subscriptionId = process.env.UID_CSTG_SUBSCRIPTION_ID;
2018
const serverPublicKey = process.env.UID_CSTG_SERVER_PUBLIC_KEY;
21-
22-
// UI/Display configuration
2319
const identityName = process.env.IDENTITY_NAME;
2420
const docsBaseUrl = process.env.DOCS_BASE_URL;
2521

26-
// SDK will be loaded dynamically (it's an ES module)
27-
let SdkClass = null;
2822

29-
// Initialize UID JavaScript SDK in a simulated browser environment using jsdom
30-
// This demonstrates that the client-side SDK works in Node.js with jsdom
23+
// additional packages/variables needed to ensure compabitibility with the SDK
24+
const { JSDOM } = require('jsdom'); // for simulating a browser environment
25+
const util = require('util'); // for polyfilling TextEncoder and TextDecoder
26+
const XMLHttpRequest = require('xhr2'); // for making HTTP requests
27+
const clientOrigin = process.env.UID_CSTG_ORIGIN || `http://localhost:${port}`; // Client origin: the URL where this app is accessible
28+
29+
30+
// Create a virtual DOM environment for the SDK to run in
31+
let SdkClass = null;
3132
let uidSdk = null;
3233
let dom = null;
3334

3435
async function initializeSDK() {
35-
// Create a virtual DOM environment for the SDK to run in
36-
// NOTE: The origin 'http://localhost:3034' must be added to your CSTG subscription's
37-
// allowed origins list by your UID2/EUID representative
3836
dom = new JSDOM('<!DOCTYPE html><html><body></body></html>', {
39-
url: 'http://localhost:3034',
37+
url: clientOrigin,
4038
runScripts: 'dangerously',
4139
resources: 'usable',
4240
pretendToBeVisual: true,
4341
});
4442

45-
// Set global variables for the SDK (SDK expects browser globals)
43+
// Polyfills for Browser APIs, SDK uses them extensively (e.g., for token storage or making network requests
4644
global.window = dom.window;
4745
global.document = dom.window.document;
4846
global.navigator = dom.window.navigator;
4947
global.localStorage = dom.window.localStorage;
5048

51-
// Polyfill Web Crypto API for jsdom (SDK uses crypto.subtle for encryption)
49+
// Polyfill Web Crypto API for jsdom (SDK uses crypto.subtle for AES-GCM encryption/decryption)
5250
Object.defineProperty(dom.window, 'crypto', {
5351
value: crypto.webcrypto,
5452
writable: false,
@@ -62,27 +60,41 @@ async function initializeSDK() {
6260
dom.window.TextDecoder = util.TextDecoder;
6361

6462
// Polyfill XMLHttpRequest with Origin header support
65-
// The SDK needs the Origin header to be set for CSTG validation
6663
const OriginalXHR = XMLHttpRequest;
6764
class XMLHttpRequestWithOrigin extends OriginalXHR {
6865
constructor() {
6966
super();
70-
this._origin = 'http://localhost:3034';
67+
this._origin = clientOrigin;
68+
this._customHeaders = {};
7169
}
7270

7371
open(method, url, async) {
7472
const result = super.open(method, url, async);
75-
// Set Origin header immediately after open (required for CSTG)
76-
super.setRequestHeader('Origin', this._origin);
7773
return result;
7874
}
75+
76+
setRequestHeader(header, value) {
77+
// Allow 'Origin' header that xhr2 normally blocks
78+
this._customHeaders[header] = value;
79+
if (header.toLowerCase() !== 'origin') {
80+
return super.setRequestHeader(header, value);
81+
}
82+
}
83+
84+
send(body) {
85+
if (!this._headers) {
86+
this._headers = {};
87+
}
88+
this._headers.origin = this._origin;
89+
90+
return super.send(body);
91+
}
7992
}
8093

8194
global.XMLHttpRequest = XMLHttpRequestWithOrigin;
8295
dom.window.XMLHttpRequest = XMLHttpRequestWithOrigin;
8396

8497
try {
85-
// Dynamically import the SDK (it's an ES module)
8698
const isEUID = identityName && identityName.toUpperCase() === 'EUID';
8799
if (isEUID) {
88100
const { EUID } = await import('@unified-id/euid-sdk');
@@ -92,10 +104,8 @@ async function initializeSDK() {
92104
SdkClass = UID2;
93105
}
94106

95-
// Instantiate the SDK (UID2 or EUID based on config)
107+
// Instantiate the SDK (UID2 or EUID based on config) with base URL
96108
uidSdk = new SdkClass();
97-
98-
// Initialize the SDK with base URL
99109
uidSdk.init({ baseUrl: uidBaseUrl });
100110

101111
return uidSdk;
@@ -121,9 +131,6 @@ app.use(nocache());
121131

122132
// Routes
123133

124-
/**
125-
* Main page - shows login form or identity result
126-
*/
127134
app.get('/', (req, res) => {
128135
res.render('index', {
129136
identity: req.session.identity || null,
@@ -200,9 +207,6 @@ app.post('/login', async (req, res) => {
200207
}
201208
});
202209

203-
/**
204-
* Logout endpoint - clears session and returns to main page
205-
*/
206210
app.get('/logout', (req, res) => {
207211
if (uidSdk && uidSdk.disconnect) {
208212
uidSdk.disconnect();

0 commit comments

Comments
 (0)