My app requests "additional access" every time the user signs in with Google

[GermanJablo]

Provider type

Google

Environment

  System:
    OS: Windows 11 10.0.22631
    CPU: (8) x64 Intel(R) Core(TM) i5-10210U CPU @ 1.60GHz
    Memory: 6.85 GB / 31.77 GB
  Binaries:
    Node: 20.11.0 - C:\Program Files\nodejs\node.EXE
    Yarn: 1.22.21 - ~\AppData\Roaming\npm\yarn.CMD
    npm: 10.2.4 - C:\Program Files\nodejs\npm.CMD
    pnpm: 8.6.5 - C:\Program Files\nodejs\pnpm.CMD
    bun: 1.1.6 - ~\AppData\Roaming\npm\bun.CMD
  Browsers:
    Edge: Chromium (125.0.2535.92)
    Internet Explorer: 11.0.22621.3527
  npmPackages:
    next: 14.1.0 => 14.1.0 
    next-auth: 4.24.5 => 4.24.5 
    react: 18.2.0 => 18.2.0 

Reproduction URL

https://github.com/GermanJablo/auth-repro

Describe the issue

My app requests "additional access" every time the user signs in with Google.

Following the answer in this thread I tried modifying the prompt parameter and although I managed to change the appearance of the consent screen (it didn't ask for additional permissions but just permissions), it still asks for them every time someone logs in.

I tried using consent and select_account in the prompt field but it didn't work.

 const providers = [
    GoogleProvider({
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
      allowDangerousEmailAccountLinking: true,
      // I tried with `prompt: "consent"` and `prompt: "select_account"` but it didn't work.
      authorization: {
        params: {
          prompt: "consent"
        }
      }
    }),
  ],

related threads:

• https://stackoverflow.com/questions/72148057/app-name-wants-additional-access-to-your-google-account
• https://stackoverflow.com/questions/14615178/why-am-i-being-prompted-to-authorize-an-oauth1-application-repeatedly-with-googl?rq=3

How to reproduce

• add GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET to .env
• pnpm install
• pnpm db:push
• pnpm dev
• log in.

Expected behavior

It should not ask for permissions every time the user logs in. As happens in https://next-auth-example.vercel.app/ (I don't know why it works there)

[GermanJablo]

@balazsorban44 I saw you moved this from issues to discussions.
Can I know why? Isn't it considered a bug?

[balazsorban44]

Based on

It should not ask for permissions every time the user logs in. As happens in https://next-auth-example.vercel.app/ (I don't know why it works there)

It sounds like a config issue or some Google magic. Hard to tell, but it cannot be counted as a bug since we cannot reliably reproduce it.

Google recently played with their login screens, maybe it's some kind of experiment. 🤷‍♂️

[GermanJablo]

we cannot reliably reproduce it.

Well, I spent about an hour doing the repro that the template requested :/

[wyking1997]

Probably the issue is related to different versions on the Vercel app or Idk. It is easy to say that the issue lies on google's side without actually looking into this, however this seems to be a problem only for next-auth. I am currently migrating a personal project from react to next, and there I use latest versions of libs as well and without any issues. Also, I am using the same google client id to authenticate there as well. Could you please assist?

[wyking1997]

What I found out so far:

When calling the signIn() function (from next-auth/react), there is a initial POST login request that is properly constructed and performed, based on the parameters set in the GoogleProvider setup, and also considers the optional parameters supplied in the function (if any). This request returns correctly the result from the login process, and every informarmation needed is already there.

For some reason however, there seems to be another GET request triggered to the following URI:
GET /api/auth/callback/google?state=RWmEIIuUG1UXUfYYu9nPwzY-fjkTnetYWuSXpczGcbM&code=4%2F0AQlEd8yy41Ge0S8MxhLjdcOFzoc0mmAyY38VVM4WqmTq21CKNnvVpGoa7qVapcV45PuDSg&scope=email+profile+openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&authuser=0&prompt=consent

This request returns a 302 which I think redirects to the consent page because it has the prompt=consent parameter set (even though in the GoogleProvider setup this was omitted). If setting the prompt value to "none" there was no prompt appearing anymore, but in this way the login failed since google has no way to know who do we want to log in. In order to fix this I added the following parameters to the singIn() function signIn("google", undefined, {login_hint: "email_that_has_already_consented@gmail.com"}). With this in place signIn works without any consent screen, so there is the option to save the user email in the local storage and take it from there, however, when local storage is removed, or new user wants to authenticate, this will not work and needs additional handling...

[wyking1997]

I was mistaken in my previous posts, the requests I am seeing are the requests to the next server. But I think that the issue is that the prompt parameter is set to consent all the time, except for the time when it is set to 'none'. Ideally, the default I think should be the 'select_account', however this option seems to be ignored by next-auth, and replaced with 'consent'. @balazsorban44 any thoughts?

as a reference, the versions I am using are below, but changing to other once did not made any difference
"next": "14.2.11",
"next-auth": "4.24.7",

[swax]

That additional code seemed to work for me

      authorization: {
        params: {
          prompt: "consent"
        }
      }

Before my login looked like this

But now it looks like this

Might be useful to add that code note to the Google provider documentation.

[GermanJablo]

Yes, that's what I meant by:

Following the answer in this thread I tried modifying the prompt parameter and although I managed to change the appearance of the consent screen (it didn't ask for additional permissions but just permissions), it still asks for them every time someone logs in.

Once you choose the Google account, what you show in your second screenshot appears, as if it were the first time you used the service.

You can see when using other services, including https://next-auth-example.vercel.app/, that this should not happen when you log back into a service you previously signed in to.

[lucaschanzx]

Facing the same problem, did you manage to find out why this is happening?

[GermanJablo]

no :(

[syan-dev]

I also have problem with this, I use the latest version 5.0.0-beta.19

[aosatinsky]

same problem here

[NahumCRep]

same here, every time i login the consent screen show up even if i already accepted terms, the screen is like the first that @swax showed, what im trying to get is when i login first time the consent screen show up thats ok but in the second login and so on, after selecting the account with which i have already accepted the terms so just login in to the app no need to show again and agian the same consent screen.

I already try changing prompt value, taking out sensitive scopes and other params but nothing seems to work.

[aliajellu]

I'm having the same issue as well. Can't get past it. Any solutions yet?
Using latest version of all nextAuth packages.

import NextAuth from "next-auth"
import GoogleProvider from "next-auth/providers/google"
import { PrismaAdapter } from "@auth/prisma-adapter"
import prisma from "@/prisma/client"

const handler = NextAuth({
  adapter: PrismaAdapter(prisma) as any,
  providers: [
    GoogleProvider({
      clientId: process.env.GOOGLE_CLIENT_ID!,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
    }),
  ],
  session: {
    strategy: "jwt",
  },
})

export { handler as GET, handler as POST }