Google token auth with Express and Passport not working - express

Question

I've made a REST api with Express which uses Passport and the passport-google-token strategy to authenticate users. It works as expected when my server is running on localhost but it doesn't work on the live version of the server. All calls return a 401 Unauthorized response.
The passport strategy is configured like this:
this.passport.use(new GoogleTokenStrategy({
clientID: this.config.auth.googleAuth.clientId,
clientSecret: this.config.auth.googleAuth.clientSecret
}, (accessToken, refreshToken, profile, done) => {
User.findOne({'google.id': profile.id}, (err, user) => {
if(err) return done(err);
if(user) return done(null, user);
var newUser = new User();
newUser.save((err) => {
if (err) throw err;
return done(null, newUser);
});
})
}));
And here's an example of an endpoint. It returns a 401 response when I hit it with a valid Google access token, but only on the live domain - it works on localhost.
app.get("/api/exists", passport.authenticate("google-token"), (req, res) => {
// stuff happens here
});
Here's what my credentials look like in the Google API manager:
If it's relevant, the client in this case is a Chrome extension which gets tokens using getAuthToken. The code that does the requests from the client looks like this:
chrome.identity.getAuthToken({"interactive": true}, (token) => {
const bodyJson = body ? JSON.stringify(body) : null;
const headers = new Headers();
headers.append("Access_token", token);
headers.append('Accept', 'application/json');
headers.append('Content-Type', 'application/json');
const request = new Request(url, {
headers: headers,
method: method,
body: bodyJson
});
fetch(request);
});
But even if I generate a token from the Google oauth playground and make the request via Postman, I get the same result: it works on localhost and doesn't work on the real domain.
What else do I need to do to authenticate users on my live domain?

Answer 1

The issue turned out to be with my Nginx server. By default it strips out headers that contain an underscore (e.g. access_token). It didn't occur to me that the problem would be there, hence not even mentioning it in my question.
Docs about that are here. You can change the behaviour by setting:
underscores_in_headers on