After first click, google-oauth screen does not show anymore? - node.js

Question

This is very odd behavior. Everytime i get a new credentials, I click on the link, I get the consent screen but after that consent screen does not show anymore but request to google server and and response to callback url is happening behind the scene. I logout user "/auth/logout", I also delete all the cookies stored manually, When I clieck on the button, I am automatically signed in again.
I belive there is nothing wrong with coding and I checked the consent screen of console.developers but there is nothing related to this issue.
this is a typescript project. here is the routes
import passport from "passport";
import { Application, Request, Response } from "express";
export const authRoutes = (app: Application) => {
app.get(
"/auth/google",
passport.authenticate("google", {
scope: ["profile", "email"],
})
);
app.get(
"/auth/google/callback",
passport.authenticate("google"),
(req: Request, res: Response) => {
res.redirect("/");
}
);
// passport sees the code here and it knows that it has to use the code to get user
app.get("/auth/current_user", (req: Request, res: Response) => {
res.send(req.user);
});
app.get("/auth/logout", (req: Request, res: Response) => {
req.logout();
res.json({ user: req.user });
});
};
here is the passport setting:
import GoogleStrategy from "passport-google-oauth20";
import passport from "passport";
import { User, UserDoc } from "../database/models/User";
// passport sets up the cookie and stuffs the user's database id not the googleId.
passport.serializeUser(
(user: UserDoc, done: (err: any, user: UserDoc) => void) => {
done(null, user.id);
}
);
passport.deserializeUser(
async (id: string, done: (err: any, user: UserDoc) => void) => {
const user = await User.findById(id);
if (user) {
done(null, user);
}
}
);
passport.use(
new GoogleStrategy.Strategy(
{
clientID: process.env.GOOGLE_CLIENT_ID!,
clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
callbackURL: "http://localhost:4500/auth/google/callback",
proxy: true,
},
async (accessToken, refreshToken, profile, done) => {
const existingUser = await User.findOne({ googleId: profile.id });
if (existingUser) {
done(undefined, existingUser);
}
const user = await new User({ googleId: profile.id }).save();
done(undefined, user);
}
)
);

Answer 1

What you're seeing is the desired behavior - once the user has granted authorization to the scopes you're asking for (that are shown in the consent screen), Google doesn't need to get the user's consent again. It keeps track of that.
Users can review and revoke access to your app (mobile or web-based) at https://myaccount.google.com/permissions. This is particularly useful during development so you don't have to constantly create new accounts to test with.