Unable to get profile information such as Name and Picture in the idToken payload from Google Provider

[vandanasriram]

Provider type

Google

Environment

System:
OS: macOS 12.4
CPU: (8) x64 Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz
Memory: 2.17 GB / 16.00 GB
Shell: 3.2.57 - /bin/bash
Binaries:
Node: 16.13.1 - /usr/local/bin/node
npm: 6.14.14 - ~/Documents/GitHub/yuser-network-web/node_modules/.bin/npm
Browsers:
Chrome: 101.0.4951.54
Safari: 15.5
npmPackages:
next: ^12.0.10 => 12.0.10
next-auth: ^3.27.3 => 3.27.3
react: ^17.0.2 => 17.0.2

Reproduction URL

nil

Describe the issue

Our application has a mobile app and web app. The mobile app is a react native app with a feathersJS server. The web app makes use of nextJS and the same feathersJS server. Currently sign up is possible only from the mobile app. The web app makes use of next-auth for sign in. Now we need to extend it to do sign up as well. We are trying to implement google, facebook and apple sign up to the nextJS application using next-auth. When we implemented google sign up, the idToken returned from next auth doesn't seem to contain profile information such as name and profile picture attributes in the payload which are vital for the way sign up is set up in our server. Is there a way to return the idToken with these details also included in it. So far we have tried editing the profile data and changing the scope of the provider which did not yield any useful result.

How to reproduce

1. Click on Sign up with google
2. Log the id token in the sign in callback (account.idToken)
3. Decode the jwt and see that the payload is missing the information such as name and profile picture

Expected behavior

The expected payload of the idToken jwt should contain all the profile related information since the scope passes the profile.

[balazsorban44]

NextAuth.js does not do anything to the content of the id_token it just passes it through from the provider. If it's missing information, the provider might be configured incorrectly. Check that scopes are correct, and that certain claims are allowed to be present in the id_token for that provider in the first place.

Some providers like IS4 for example let you configure this, I'm not sure about Google, and I couldn't link to their documentation that would help either, unfortunately.

That said, we decode the token and all information should be available in OAuthProfile, so if that's missing certain fields, it's already an indication that the id_token was incomplete.

FWIW, here is my decoded id_token:

{
  iss: 'https://accounts.google.com',
  azp: '***.apps.googleusercontent.com',
  aud: '***.apps.googleusercontent.com',
  sub: '111788689787958170610',
  email: '***',
  email_verified: true,
  at_hash: 'aeZ8Ct_QsOBpI8vv5-PdNg',
  name: 'NextAuth Test',
  picture: 'https://lh3.googleusercontent.com/a-/AOh14GjRfRKa3CYlPLZz1JcM0WLj20jkAK83ssPOsszE=s96-c',
  given_name: 'NextAuth',
  family_name: 'Test',
  locale: 'en-GB',
  iat: 1651827405,
  exp: 1651831005
}

Config is here:

next-auth/apps/dev/pages/api/auth/[...nextauth].ts

Lines 109 to 112 in 8b6d2e3

	GoogleProvider({
	clientId: process.env.GOOGLE_ID,
	clientSecret: process.env.GOOGLE_SECRET,
	}),

[vandanasriram]

Hey @balazsorban44 ,
The nextauth.js our application use looks like this. For google, we make use of the default provider settings(scope not explicitely mentioned)
The config used is:

Providers.Google({
            name: 'Google',

            clientId: process.env.GOOGLE_CLIENT_ID,
            clientSecret: process.env.GOOGLE_CLIENT_SECRET_MOD,
  
        }),

The signin callback is as follows:

 async signIn(user, account, profile) {
            console.log(profile,"profile") //---------------------Log for prof -------------------//
            console.log(user,"user")        //---------------------Log for user -------------------//
            console.log(account,"account") //------------------Log for account ---------------//
            if (account.provider === 'google') {

                const temp = await client.authenticate({
                    strategy: "google",
                    generatedToken: account.idToken,
                    type: "web-app",
                    inviteCode:"44L9BX",
                    unverifiedPhoneNum:"15196974485"
                }, null)

                const { accessToken } = temp
       
                user.provider = "google"
                if (accessToken) {
                    return true
                }
                else return false

            }
            
        },

The logs obtained are:
profile:

{
  id: '106344082146571744223',
  email: 'nextauthtest1@gmail.com',
  verified_email: true,
  name: 'nextAuthtest1 nil',
  given_name: 'nextAuthtest1',
  family_name: 'nil',
  picture: 'https://lh3.googleusercontent.com/a/AATXAJwQB5RlBOVehdGvaGmm0ojViGiRsSN6_Y33RuB-=s96-c',
  locale: 'en'
}

user:

{
  id: '106344082146571744223',
  name: 'nextAuthtest1 nil',
  email: 'nextauthtest1@gmail.com',
  image: 'https://lh3.googleusercontent.com/a/AATXAJwQB5RlBOVehdGvaGmm0ojViGiRsSN6_Y33RuB-=s96-c'
} 

The id-token decoded:

{
  "iss": "accounts.google.com",
  "azp": "384932105507-fcd24ed62ghdj4hgq8ppki7esl1qrqu4.apps.googleusercontent.com",
  "aud": "384932105507-fcd24ed62ghdj4hgq8ppki7esl1qrqu4.apps.googleusercontent.com",
  "sub": "106344082146571744223",
  "email": "nextauthtest1@gmail.com",
  "email_verified": true,
  "at_hash": "27JYit_-MGhUdHTBG77oBQ",
  "iat": 1651846194,
  "exp": 1651849794
}

The default scope from account is:
scope: 'https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email openid',

Although the profile appears to have the right information, when it comes to the id-token, the information name, given name, family name and picture seem to be missing. We are making use of the version 3.27.3 for next auth. Is there something that is missing in the configuration which is potentially affecting the id-token. Kindly let us know if there is anything wrong in the way it is implemented. Thanks in advance

[lewis-cobry]

I'm also experiencing this issue but it's only with some user accounts. I've checked for privacy policies on the affected accounts but there doesn't seem to be anything to suggest that that's the problem.

[andrehadianto]

I'm having a similar issue with this. Will be waiting for a new update on this thread.