Feature/nonce check type #4100

james-bjss · 2022-03-02T18:01:44Z

Reasoning 💡

Adding the ability to generate and validate a nonce value when authenticating against an Open ID provider.

This resolves a "nonce missmatch" error raised when authenticating against an external IDP with Cognito.

Specifically this is to fix the following issue: #3551

Checklist 🧢

Documentation
Tests
Ready to be merged

Affected issues 🎟

Fixes: #3551

Notes On Usage

This has been Tested with Local Cognito users, Cognito + AAD and also in combination with PKCE and State checks.
By default the check is disabled but can be enabled by setting the appropriate checks value eg.

import NextAuth from 'next-auth'
import CognitoProvider from 'next-auth/providers/cognito'

const handler = NextAuth({
  providers: [
    CognitoProvider({
      clientId: process.env.COGNITO_CLIENT_ID,
      clientSecret: process.env.COGNITO_CLIENT_SECRET,
      issuer: process.env.COGNITO_ISSUER,
      idToken: true,
      checks: 'nonce',
    }),
  ],
})

export default handler

vercel · 2022-03-02T18:01:50Z

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/nextauthjs/next-auth/HggmkVHNf7hrWyf2YA3TjN518wT6
✅ Preview: https://next-auth-git-fork-james-bjss-feature-nonce-c-021620-nextauthjs.vercel.app

packages/next-auth/src/providers/oauth.ts

james-bjss · 2022-03-05T17:03:59Z

@balazsorban44 - If you require a test-cognito endpoint and credentials I can potentially set this up for you on my personal account, just give me some notice and I can set it up :)

james-bjss · 2022-03-13T12:59:58Z

Hi @balazsorban44 sorry to bug you, but would it be possible to give an indication if this fix is viable and something you may be willing to accept into the project?

I wouldn't normally chase up on PRs, but we are faced with a difficult decision on our project at the moment. Basically:

Continue to use NextAuth with a fork containing this PR in the hope that the issue will be eventually be fixed.
Start looking at refactoring to use Amplify libraries (which potentially brings with it other issues)

I realise this is a side-project and you are busy, but just looking for some confidence that a fix will be forthcoming if we chose Option1 even if its not immediate.

james-bjss · 2022-03-21T09:52:18Z

Hi @balazsorban44 sorry to bug you, but would it be possible to give an indication if this fix is viable and something you may be willing to accept into the project?

I wouldn't normally chase up on PRs, but we are faced with a difficult decision on our project at the moment. Basically:

Continue to use NextAuth with a fork containing this PR in the hope that the issue will be eventually be fixed.

Start looking at refactoring to use Amplify libraries (which potentially brings with it other issues)

I realise this is a side-project and you are busy, but just looking for some confidence that a fix will be forthcoming if we chose Option1 even if its not immediate.

@ThangHuuVu @ndom91 - Sorry to tag you but would you be able to answer the above?

balazsorban44 · 2022-03-21T14:43:29Z

Hi, I'm sorry, I'm currently taking a small break from the project to work through personal issues. Thanks for tagging the others.

I'll look into all PRs once I feel better. 💚🙏

james-bjss · 2022-03-21T16:41:38Z

Hi, I'm sorry, I'm currently taking a small break from the project to work through personal issues. Thanks for tagging the others.

I'll look into all PRs once I feel better. 💚🙏

No problem. Thanks for letting us know. Take care of yourself and hope you feel better soon!

ndom91 · 2022-03-22T22:11:52Z

Hi james, so from my side this looks like it makes a lot of sense and the PR looks clean as well. I dont want to speak for Balazs and we're waiting to release any versions on him anyway, but for the time being you could use something like patch-package to get your own copy up and running with this patch in it.

ThangHuuVu

I have a comment about docs

docs/versioned_docs/version-v3/configuration/options.md

ndom91 · 2022-03-25T22:44:02Z

Thanks James! I'll mark this as "ready" so we can take a look as soon as we continue with cutting releases 👍

kd-tony · 2022-05-14T03:52:37Z

@ndom91 @james-bjss We're also facing the same issues with this missing nouce check type. Any updates on this PR and when it will be a candidate for a release ?

james-bjss · 2022-05-17T23:08:25Z

@ndom91 @james-bjss We're also facing the same issues with this missing nouce check type. Any updates on this PR and when it will be a candidate for a release ?

Hi Sorry, I don't have any news I am also keen to see this merged too. We are currently using the code form this PR with patch-package method suggested above.

w0otness · 2022-05-18T02:58:29Z

can you share the patch-package you use?

ndom91 · 2022-05-18T14:54:31Z

can you share the patch-package you use?

Probably this one: https://www.npmjs.com/package/patch-package

lpanjwani · 2022-05-18T15:04:28Z

I have created a patch package on NPM until this PR has been merged.

https://www.npmjs.com/package/next-auth-patch-feature-nonce-check

w0otness · 2022-05-18T22:06:27Z

I currently use this patches/openid-client+5.1.6.patch which disables the nonce check and bypasses the nonce error, and the sign in process is seamless.

I'll try replacing the entire package with the patched one (though a gist containing the .patch would be preferable) to see if I get the extra protection of the nonce.

hamidbjss · 2022-05-20T10:54:14Z

I currently use this patches/openid-client+5.1.6.patch which disables the nonce check and bypasses the nonce error, and the sign in process is seamless.

I'll try replacing the entire package with the patched one (though a gist containing the .patch would be preferable) to see if I get the extra protection of the nonce.

@w0otness I created a gist of the patch we use: https://gist.github.com/hamidbjss/b6408e48080f247edd22ec04a3b983e3

vercel · 2022-05-25T13:38:50Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Ignored Deployment

Name	Status	Preview	Updated
next-auth	⬜️ Ignored (Inspect)		Aug 16, 2022 at 8:20AM (UTC)

hamidbjss · 2022-08-03T14:56:50Z

Created a patch for version 4.10.3 if it's of help to anyone next-auth+4.10.3.patch.

@balazsorban44 @ndom91 @ThangHuuVu @lluia really would be good if we could get this merged in please, it's a pain having to constantly create new patches.

revmischa · 2022-08-12T22:11:46Z

This error is blocking me from using a third-party IDP with Cognito nonce mismatch, expected undefined

james-bjss · 2022-08-13T09:52:49Z

This error is blocking me from using a third-party IDP with Cognito nonce mismatch, expected undefined

You can use the patch provided by @hamidbjss above until this is merged.

This PR seems to be in limbo though. Posts above do suggest that it's being considered as a candidate for a new release but it doesn't look like there is a roadmap for future releases and the only changes that are being merged currently are critical fixes and doc changes.

I understand the pressures of maintaining a popular OS project and am immensely grateful for this great library, but it's quite dissappointing when asked to raise a PR for a fix and it just languishes for 6months. We chose to stick with nextauth as we thought this would likely be fixed in the future.

@ndom91 would it be possible to get an update on why it has stalled? It's clear it is affecting a number of people who have chosen to use this lib (have seen this pop up on stack overflow too).
Even if we could get a beta/branch build of the fix it would be nice. Or if it's concerns over the change, issues testing or that next release is not yet scheduled till x date etc.. Just some response to keep us updated.

Sorry for the nagging!

Also, for what its worth we have been using the patched version for many months now without issue.

ThangHuuVu

Folks, we understand your frustration, and are sorry for the delayed action.

@james-bjss I just tested this PR locally with Google using nonce with and without state and pkce, everything works as expected. 🎉 I also added some comments, could you check and let me know what you think? Thanks again for the PR! Let's work together to get this one merged soon 🙌

packages/next-auth/src/core/lib/oauth/callback.ts

packages/next-auth/src/core/lib/oauth/nonce-handler.ts

Co-authored-by: Thang Vu <thvu@hey.com>

packages/next-auth/src/core/lib/oauth/authorization-url.ts

james-bjss · 2022-08-15T09:32:53Z

Folks, we understand your frustration, and are sorry for the delayed action.

@james-bjss I just tested this PR locally with Google using nonce with and without state and pkce, everything works as expected. 🎉 I also added some comments, could you check and let me know what you think? Thanks again for the PR! Let's work together to get this one merged soon 🙌

Great. Thanks! Just going ahead and making these changes and we will test with Cognito + IDP (Azure AD) and will update on status.

james-bjss · 2022-08-15T10:59:46Z

Folks, we understand your frustration, and are sorry for the delayed action.
@james-bjss I just tested this PR locally with Google using nonce with and without state and pkce, everything works as expected. 🎉 I also added some comments, could you check and let me know what you think? Thanks again for the PR! Let's work together to get this one merged soon 🙌

Great. Thanks! Just going ahead and making these changes and we will test with Cognito + IDP (Azure AD) and will update on status.

@ThangHuuVu - @hamidbjss and I have tested this against our Cognito setup and it works as-expected with those changes.

james-bjss · 2022-08-16T10:33:50Z

Thanks @ThangHuuVu and all. Sorry for all the nagging! This will be a huge help to our team. 🌟 Have donated you all some beer money :)

mocon · 2022-08-19T13:40:26Z

Hey team, thanks for all your hard work on this! Will these changes be released in a new version?

kesoji · 2022-08-28T02:19:46Z

I'm all excited about it to be released 😊

james-bjss · 2022-09-28T09:46:50Z

This is now available in the latest release (though is absent from release notes). Will. Zap my fork in the next few days,

matewilk · 2022-10-08T21:40:54Z

This is now available in the latest release (though is absent from release notes). Will. Zap my fork in the next few days,

Hmm..that's interesting, today I installed:

"next-auth": "^4.12.3",

with the following configuration:

providers: [
    CognitoProvider({
      clientId: process.env.COGNITO_CLIENT_ID,
      clientSecret: process.env.COGNITO_CLIENT_SECRET,
      issuer: process.env.COGNITO_ISSUER,
      idToken: true,
      checks: "nonce",
    } as OAuthUserConfig<CognitoProfile>),
  ],

And I'm still getting:

providerId: 'cognito',
message: 'nonce mismatch, expected undefined, got: 3C_ehdfrp6g ..... U8KNWxYvBf0f14FJYblKDvI0r-WZJ8'

Am I missing something?

kesoji · 2022-10-09T07:36:56Z

@matewilk I think checks should be array of string, not a string.
Try checks: ["nonce"]

schorfES · 2022-10-10T07:23:54Z

The typings in typescript tell (assuming they are correct) that checks could be either a string literal or an array of string literals. Theoretically, both should work... I am using checks: "nonce" and don't see any of the errors @matewilk reported.

declare type ChecksType = "pkce" | "state" | "none" | "nonce";

// ...

export interface OAuthConfig<P> extends CommonProviderOptions, PartialIssuer {

  // ...

  checks?: ChecksType | ChecksType[];

  // ...

}

hamidbjss · 2022-10-10T08:42:03Z

@matewilk you should be able to provide an array or string literal.

Your config seems fine. I'd perhaps follow the usual troubleshooting steps:

Clear cache in browser
Remove node modules and re-install
Regenerate the package-lock file and re-install node modules

mohammed-rashik-1403 · 2023-12-03T05:53:16Z

next-auth.session-token cookie is not set when I deployed to aws but works fine in vercel

mohammed-rashik-1403 · 2023-12-03T05:55:34Z

import NextAuth from 'next-auth';
import AzureADProvider from 'next-auth/providers/azure-ad';
import CognitoProvider from 'next-auth/providers/cognito';

/*
Counsellor SSO login config file
NextAuth with AzureADProvider
*/
export const authOptions = {
providers: [
CognitoProvider({
clientId: 241g55s6j05sqhc60pfv57if7t,
clientSecret: null,
issuer: https://cognito-idp.ap-southeast-1.amazonaws.com/ap-southeast-1_JtDXYUi6b,
//idToken: true,
client: {
token_endpoint_auth_method: "none"
},
checks: ["nonce","session-token"],

}),
AzureADProvider({
  clientId: `655d42ce-169d-45ed-88e0-7f23ac4ca837`,
  clientSecret: `nda8Q~GUCaBdZsm_5avtQvhRWZx7d1yZmUNooaAh`,
  tenantId: `c0c7ad79-cf13-4f39-8eeb-a1829aa096a6`,
  checks: 'both',
  authorization: {
    params: { scope: 'openid email profile User.Read  offline_access' },
  },
  httpOptions: { timeout: 10000 },
}),

],
secret : "qJ8Zg4buf9bFLO2knTn40Tnqatfdm1BNVRQ0GFXCX6w=",
callbacks: {
async jwt({ token, user, account }) {
console.log("tokeeeeeeeeeeeeeeeeee",token)
console.log("tokeeeeeeaccounteeeeeeeeeeee",account)
console.log("tokeeeeeeeusereeeeeeeeeee",user)
return token;

},
async session({ session, token }) {
  if (session) {
    session.user = token.user;
    session.user = token.user;
    session.error = token.error;
    session.accessToken = token.accessToken;
  }
  return session;
},

async redirect({ url, baseUrl }) {
return url.startsWith(baseUrl) ? url : baseUrl;

},

},
session: {
jwt: true,
useToken: true,
cookie: {
secure: true,
sameSite: 'None',
},
},
cookies: {
sessionToken: {
name: next-auth.session-token,
options: {
httpOnly: true,
sameSite: "lax",
path: "/",
secure: true,
domain: '.d3jsaq6594du80.cloudfront.net'
}
},
callbackUrl: {
name: next-auth.callback-url,
options: {
httpOnly: true,
sameSite: 'none',
path: '/',
secure: true
}
},
csrfToken: {
name: 'next-auth.csrf-token',
options: {
httpOnly: true,
sameSite: 'none',
path: '/',
secure: true
}
},
pkceCodeVerifier: {
name: 'next-auth.pkce.code_verifier',
options: {
httpOnly: true,
sameSite: 'none',
path: '/',
secure: true
}
},
state: {
name: next-auth.state,
options: {
httpOnly: true,
sameSite: 'none',
path: "/",
secure: true,
},
},
nonce: {
name: next-auth.nonce,
options: {
httpOnly: true,
sameSite: "none",
path: "/",
secure: true,
},
},
},

};

export default NextAuth(authOptions);

jwt callback was fine but session callback is not triiggered

james-bjss requested review from balazsorban44 and ndom91 as code owners March 2, 2022 18:01

vercel bot temporarily deployed to Preview March 2, 2022 18:01 Inactive

github-actions bot added core Refers to `@auth/core` providers TypeScript Issues relating to TypeScript labels Mar 2, 2022

james-bjss commented Mar 2, 2022

View reviewed changes

packages/next-auth/src/providers/oauth.ts Outdated Show resolved Hide resolved

vercel bot temporarily deployed to Preview March 3, 2022 09:28 Inactive

ThangHuuVu reviewed Mar 23, 2022

View reviewed changes

docs/versioned_docs/version-v3/configuration/options.md Outdated Show resolved Hide resolved

vercel bot temporarily deployed to Preview March 23, 2022 09:29 Inactive

ndom91 added the ready Ready to merge label Mar 25, 2022

balazsorban44 mentioned this pull request Apr 5, 2022

feat(core): make next-auth optionally opt-into Web-compatible mode #4299

Closed

5 tasks

feat: add nonce check type

06f1021

hamidbjss force-pushed the feature/nonce-check-type branch from 72f663d to 06f1021 Compare May 25, 2022 13:38

vercel bot temporarily deployed to Preview August 3, 2022 13:35 Inactive

ThangHuuVu requested changes Aug 14, 2022

View reviewed changes

packages/next-auth/src/core/lib/oauth/callback.ts Outdated Show resolved Hide resolved

packages/next-auth/src/core/lib/oauth/callback.ts Outdated Show resolved Hide resolved

packages/next-auth/src/core/lib/oauth/nonce-handler.ts Outdated Show resolved Hide resolved

james-bjss and others added 2 commits August 15, 2022 08:35

Update packages/next-auth/src/core/lib/oauth/callback.ts

b50b0a6

Co-authored-by: Thang Vu <thvu@hey.com>

Add further info to debug msg as per PR suggestion

a144570

kesoji reviewed Aug 15, 2022

View reviewed changes

packages/next-auth/src/core/lib/oauth/authorization-url.ts Outdated Show resolved Hide resolved

Cast OauthChecks as OpenIDCallbackChecks

6205752

Merge branch 'main' into feature/nonce-check-type

e4f2b71

vercel bot temporarily deployed to Preview August 15, 2022 12:27 Inactive

Update order of imports as per PR suggestion

1345081

james-bjss requested a review from ThangHuuVu August 16, 2022 08:49

ThangHuuVu approved these changes Aug 16, 2022

View reviewed changes

ThangHuuVu merged commit d349ae2 into nextauthjs:main Aug 16, 2022

james-bjss deleted the feature/nonce-check-type branch August 16, 2022 10:23

james-bjss restored the feature/nonce-check-type branch August 16, 2022 10:23

hamidbjss had a problem deploying to Preview September 15, 2022 09:47 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/nonce check type #4100

Feature/nonce check type #4100

james-bjss commented Mar 2, 2022 •

edited

Loading

vercel bot commented Mar 2, 2022 •

edited

Loading

james-bjss commented Mar 5, 2022 •

edited

Loading

james-bjss commented Mar 13, 2022

james-bjss commented Mar 21, 2022

balazsorban44 commented Mar 21, 2022 •

edited

Loading

james-bjss commented Mar 21, 2022

ndom91 commented Mar 22, 2022 •

edited

Loading

ThangHuuVu left a comment

ndom91 commented Mar 25, 2022

kd-tony commented May 14, 2022

james-bjss commented May 17, 2022 •

edited

Loading

w0otness commented May 18, 2022

ndom91 commented May 18, 2022

lpanjwani commented May 18, 2022

w0otness commented May 18, 2022

hamidbjss commented May 20, 2022 •

edited

Loading

vercel bot commented May 25, 2022 •

edited

Loading

hamidbjss commented Aug 3, 2022

revmischa commented Aug 12, 2022

james-bjss commented Aug 13, 2022

ThangHuuVu left a comment

james-bjss commented Aug 15, 2022

james-bjss commented Aug 15, 2022 •

edited

Loading

james-bjss commented Aug 16, 2022 •

edited

Loading

mocon commented Aug 19, 2022

kesoji commented Aug 28, 2022

james-bjss commented Sep 28, 2022

matewilk commented Oct 8, 2022 •

edited

Loading

kesoji commented Oct 9, 2022

schorfES commented Oct 10, 2022

hamidbjss commented Oct 10, 2022 •

edited

Loading

mohammed-rashik-1403 commented Dec 3, 2023

mohammed-rashik-1403 commented Dec 3, 2023

Feature/nonce check type #4100

Feature/nonce check type #4100

Conversation

james-bjss commented Mar 2, 2022 • edited Loading

Reasoning 💡

Checklist 🧢

Affected issues 🎟

Notes On Usage

vercel bot commented Mar 2, 2022 • edited Loading

james-bjss commented Mar 5, 2022 • edited Loading

james-bjss commented Mar 13, 2022

james-bjss commented Mar 21, 2022

balazsorban44 commented Mar 21, 2022 • edited Loading

james-bjss commented Mar 21, 2022

ndom91 commented Mar 22, 2022 • edited Loading

ThangHuuVu left a comment

Choose a reason for hiding this comment

ndom91 commented Mar 25, 2022

kd-tony commented May 14, 2022

james-bjss commented May 17, 2022 • edited Loading

w0otness commented May 18, 2022

ndom91 commented May 18, 2022

lpanjwani commented May 18, 2022

w0otness commented May 18, 2022

hamidbjss commented May 20, 2022 • edited Loading

vercel bot commented May 25, 2022 • edited Loading

hamidbjss commented Aug 3, 2022

revmischa commented Aug 12, 2022

james-bjss commented Aug 13, 2022

ThangHuuVu left a comment

Choose a reason for hiding this comment

james-bjss commented Aug 15, 2022

james-bjss commented Aug 15, 2022 • edited Loading

james-bjss commented Aug 16, 2022 • edited Loading

mocon commented Aug 19, 2022

kesoji commented Aug 28, 2022

james-bjss commented Sep 28, 2022

matewilk commented Oct 8, 2022 • edited Loading

kesoji commented Oct 9, 2022

schorfES commented Oct 10, 2022

hamidbjss commented Oct 10, 2022 • edited Loading

mohammed-rashik-1403 commented Dec 3, 2023

mohammed-rashik-1403 commented Dec 3, 2023

james-bjss commented Mar 2, 2022 •

edited

Loading

vercel bot commented Mar 2, 2022 •

edited

Loading

james-bjss commented Mar 5, 2022 •

edited

Loading

balazsorban44 commented Mar 21, 2022 •

edited

Loading

ndom91 commented Mar 22, 2022 •

edited

Loading

james-bjss commented May 17, 2022 •

edited

Loading

hamidbjss commented May 20, 2022 •

edited

Loading

vercel bot commented May 25, 2022 •

edited

Loading

james-bjss commented Aug 15, 2022 •

edited

Loading

james-bjss commented Aug 16, 2022 •

edited

Loading

matewilk commented Oct 8, 2022 •

edited

Loading

hamidbjss commented Oct 10, 2022 •

edited

Loading