Question 1

How to redirect unauthenticated users to /login in NodeBB plugin for both page loads and AJAX navigation?

Accepted Answer

Use `router.use` instead of `app.use` when defining middleware. For API routes (`/api/...`), set `res.locals.isAPI = true` before redirecting. Example middleware:

```javascript
// In your plugin's init
router.use(async (req, res, next) => {
  if (!req.uid && !req.path.startsWith('/login') && !req.path.startsWith('/api/login')) {
    if (req.path.startsWith('/api/')) {
      helpers.notAllowed(res, { error: 'not-logged-in' }); // or res.status(403).json(...)
    } else {
      res.redirect('/login');
    }
    return;
  }
  next();
});
```

This prevents the `t.template is undefined` error when AJAX navigation loads a route that requires login.

Question 2

Why do DELETE requests with a request body fail on certain NodeBB API endpoints?

Accepted Answer

In recent NodeBB updates, many DELETE endpoints have been refactored to no longer accept parameters via `req.body`. Use query parameters instead. For example:

- `DELETE /api/files` now requires `?path=...`
- `DELETE /api/categories/:cid/thumbs` uses `?path=...`
- `DELETE /api/categories/:cid/watch`, `/privileges/:privilege`, `/follow` no longer read body.

Exceptions remain for user management: `DELETE /api/user/:uid`, `/user/:uid/content`, and `/user/:uid/account` still require `password` in the request body for security. Update your client to send data via query string where applicable. See PR #14184 for full list of changes.

Question 3

How to integrate a custom login strategy without external callback in NodeBB?

Accepted Answer

The `filter:auth.init` hook expects a passport-based strategy with a callback URL. For a self-contained custom logic (no external redirect), use the `action:auth.overrideLogin` hook instead. This hook allows you to directly authenticate a user without requiring a callback flow.

Example:
```javascript
// In your plugin
myPlugin.overrideLogin = async function(data) {
  // data.req and data.res are available
  // Perform custom authentication logic
  const user = await authenticateUser(data.req);
  if (user) {
    await plugins.fireHook('static:app.login', { req: data.req, res: data.res, user: user });
    data.res.send('success'); // Or redirect
  } else {
    data.res.status(403).send('Login failed');
  }
};

// Register the hook
plugin.registerHook = async function(data) {
  plugin.hooks = [
    { hook: 'action:auth.overrideLogin', method: 'overrideLogin' }
  ];
};
```
Note: `action:auth.overrideLogin` bypasses the passport flow entirely, so you must handle session and cookie creation manually (or use the built-in helpers like `static:app.login`).

Question 4

Why does NodeBB 1.17 crash with 'Cannot read property 'push' of undefined' in nodebb-plugin-sso-twitter?

Accepted Answer

This is a compatibility issue with older versions of nodebb-plugin-sso-twitter when running NodeBB v1.17.0. Update the plugin to the latest version to fix it:

```bash
npm install nodebb-plugin-sso-twitter@latest
```

If you have other SSO plugins (GitHub, Facebook, etc.), update them as well, as they may have similar fixes. After updating, restart NodeBB with `./nodebb restart`.

NodeBB

Core Features

What It Can't Do

Use Cases

Tags

Getting Started

Similar Projects