feat(core): make `next-auth` optionally opt-into Web-compatible mode #4299

ThangHuuVu · 2022-04-01T08:59:00Z

Reasoning 💡

🚧 WIP

This PR removes openid-client dependency and adds oauth4webapi. It would decouple NextAuth.js from Node.js and enable us to run NextAuth.js on other JS runtimes like the edge runtime.

Notes on using PKCE and state/nonce

PKCE is always used. See: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-2.1.1
If PKCE support is missing (either missing from AS metadata or we are not sure), use state in addition. Nonce support for OpenID is WIP at #4100

Checklist 🧢

Affected issues 🎟

References

https://github.com/panva/oauth4webapi/blob/main/examples/code.ts
https://github.com/panva/oauth4webapi/blob/main/examples/oauth.ts

vercel · 2022-04-01T08:59:06Z

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/nextauthjs/next-auth/DUoR4N6DybecdR4evEHQzWcVYeR1
✅ Preview: Canceled

[Deployment for 2267292 canceled]

packages/next-auth/src/core/lib/oauth/state-handler.ts

ThangHuuVu · 2022-04-01T15:58:08Z

packages/next-auth/src/providers/oauth.ts

@@ -112,8 +98,8 @@ export interface OAuthConfig<P> extends CommonProviderOptions, PartialIssuer {
  version?: string
  profile?: (profile: P, tokens: TokenSet) => Awaitable<User & { id: string }>
  checks?: ChecksType | ChecksType[]
-  client?: Partial<ClientMetadata>
-  jwks?: { keys: JWK[] }


We might not need this anymore, as the new Client doesn't require it.

This exists to be able to override the usage of openid-client. I wonder if we can truly get rid of it and still be flexible. We should discuss.

Example: #4286

How could we solve it otherwise?

ThangHuuVu · 2022-04-01T15:58:30Z

packages/next-auth/src/providers/oauth.ts

@@ -130,9 +116,6 @@ export interface OAuthConfig<P> extends CommonProviderOptions, PartialIssuer {
  region?: string
  // TODO: only allow for some
  issuer?: string
-  /** Read more at: https://github.com/panva/node-openid-client/tree/main/docs#customizing-http-requests */
-  httpOptions?: HttpOptions


This is specific to Node.js

ThangHuuVu · 2022-04-01T16:01:34Z

packages/next-auth/src/providers/oauth.ts

     */
-    checks: OAuthChecks


I removed this because I think it's unnecessary. I couldn't find the equivalent in oauth4webapi

It's basically the way to tell if the provider wants to use state, pkce, both or none. (nonce support is WIP #4100, but I haven't had the time to have a look yet).

If omitted, our default is to use state currently.

ThangHuuVu · 2022-04-01T16:02:37Z

packages/next-auth/src/providers/facebook.ts

@@ -18,13 +18,13 @@ export default function Facebook<
      url: "https://graph.facebook.com/me",
      // https://developers.facebook.com/docs/graph-api/reference/user/#fields
      params: { fields: "id,name,email,picture" },
-      async request({ tokens, client, provider }) {


I'm leaving this out because I'm not sure about the API. Can't we abstract this away?

Unfortunately, the request method was added (see #1846) to support providers that do not follow the spec properly... It's a shame that Facebook doesn't do it. (Note, it might have changed since, but I haven't checked in a while). If we can get rid of it, I'm all for though. But there might be other providers still using it.

We should discuss if we want to start discouraging (read: drop support/request) providers that do not implement the spec 100% correctly...

What I absolutely want to avoid is to go back to handling provider-specific stuff in our core. (eg if (provider.id === "facebook"), etc.)

See also #4299 (comment)

test

- handle pkce discovery - update `validateAuthResponse` to use `expectState`

panva · 2022-04-07T08:21:22Z

packages/next-auth/src/core/lib/oauth/callback.ts

@@ -5,11 +5,10 @@ import { usePKCECodeVerifier } from "./pkce-handler"
 import { OAuthCallbackError } from "../../errors"
 import {
  authorizationCodeGrantRequest,
+  clientCredentialsGrantRequest,


Suggested change

clientCredentialsGrantRequest,

panva · 2022-04-07T08:22:04Z

packages/next-auth/src/core/lib/oauth/pkce-handler.ts

-  if (!provider?.checks?.includes("pkce") || !codeVerifier) {
+  if (
+    !provider?.checks?.includes("pkce") ||
+    !codeVerifier ||


Suggested change

!codeVerifier ||

panva · 2022-04-07T08:22:44Z

packages/next-auth/src/core/lib/oauth/pkce-handler.ts

+  if (
+    !provider?.checks?.includes("pkce") ||
+    !codeVerifier ||
+    code_challenge_methods_supported?.length === 0


Suggested change

code_challenge_methods_supported?.length === 0

code_challenge_methods_supported?.includes('S256') === false

ThangHuuVu · 2022-04-07T08:23:18Z

packages/next-auth/src/core/lib/oauth/callback.ts

+      client,
+      callbackParameters,
+      provider.callbackUrl,
+      pkce?.codeVerifier as string


I need to ask Filip about this, as I'm not sure how to call this method without the codeVerifier.

You don't, that's the whole point. The API is designed so that you always use S256 PKCE. The discussion we had about AS not supporting PKCE means that you'd use nonce (if openid), or state (if not openid) in addition to PKCE since you don't know if PKCE is supported or not.

Thanks for taking a look, @panva! 🙏

I thought that this API would also handle requesting the access token in the cases PKCE is not supported, like https://www.rfc-editor.org/rfc/rfc6749.html#section-4.1 and https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth. How would you suggest we make the token request in those cases?

The client always uses PKCE. And in cases where you're not sure if PKCE is supported on the AS you still use PKCE but add nonce (when using OIDC) or state (when not using OIDC).

Got it, I just updated the PKCE handler to always return a value. 🙏

vercel · 2022-06-10T09:02:38Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated
next-auth	✅ Ready (Inspect)	Visit Preview	Oct 7, 2022 at 0:21AM (UTC)

david58 · 2022-10-05T12:43:01Z

With the upcoming end of the active phase of node 16, is there a plan to move this forward as it seems to be the main blocker of official support of higher versions?

ThangHuuVu · 2022-10-06T00:42:30Z

@david58 there is another blocker prior to this PR: #4769 👀 Hope to ship this soon, too 🙌

balazsorban44 · 2022-10-10T03:10:55Z

Superseded by #5536

vercel bot temporarily deployed to Preview April 1, 2022 08:59 Inactive

github-actions bot added core Refers to `@auth/core` providers TypeScript Issues relating to TypeScript labels Apr 1, 2022

ThangHuuVu commented Apr 1, 2022

View reviewed changes

packages/next-auth/src/core/lib/oauth/state-handler.ts Outdated Show resolved Hide resolved

ThangHuuVu commented Apr 1, 2022

View reviewed changes

ThangHuuVu self-assigned this Apr 4, 2022

replace openid-client with oauth4webapi

e3e3cf1

ThangHuuVu force-pushed the feat/oauth4webapi branch from 260f2b2 to e3e3cf1 Compare April 4, 2022 08:15

vercel bot temporarily deployed to Preview April 4, 2022 08:15 Inactive

ThangHuuVu changed the title ~~replace openid-client with oauth4webapi~~ breaking: replace openid-client with oauth4webapi Apr 6, 2022

Revert most breaking changes.

6df5773

test

vercel bot temporarily deployed to Preview April 6, 2022 09:31 Inactive

ThangHuuVu added 2 commits April 6, 2022 17:33

Check state only if pkce is not suported

1365211

Throw better error

70a16e8

vercel bot temporarily deployed to Preview April 6, 2022 10:36 Inactive

Some improvement

ebcc328

- handle pkce discovery - update `validateAuthResponse` to use `expectState`

vercel bot temporarily deployed to Preview April 7, 2022 08:15 Inactive

panva reviewed Apr 7, 2022

View reviewed changes

ThangHuuVu commented Apr 7, 2022

View reviewed changes

Always use PKCE

029edb9

vercel bot temporarily deployed to Preview April 7, 2022 11:47 Inactive

check if PKCE supported

883b36e

vercel bot temporarily deployed to Preview April 7, 2022 13:40 Inactive

Improve pkce

2267292

vercel bot temporarily deployed to Preview April 8, 2022 02:13 Inactive

balazsorban44 mentioned this pull request Apr 29, 2022

Downgrading to Node 16.10 not possible #4485

Closed

balazsorban44 mentioned this pull request May 31, 2022

Possible update Node 18 #4575

Closed

Thang Vu added 2 commits June 10, 2022 15:55

Merge branch 'main' into feat/oauth4webapi

6dd4400

Update pnpm-lock.yaml

acc9966

balazsorban44 mentioned this pull request Jun 12, 2022

Add node v17 as a supported version #4701

Closed

3 tasks

Merge branch 'main' into feat/oauth4webapi

bf31512

vercel bot temporarily deployed to Preview June 20, 2022 05:04 Inactive

ThangHuuVu added 2 commits June 20, 2022 14:04

Merge branch 'main' into feat/oauth4webapi

2eef2f8

Update pnpm-lock.yaml

f48e0f1

balazsorban44 mentioned this pull request Jun 26, 2022

refactor(core): use standard Request and Response #4769

Merged

3 tasks

c-ehrlich mentioned this pull request Jun 27, 2022

yarn create t3-app crashes with Node 18 (next-auth or @next-auth/prisma-adapter incompatibility?) t3-oss/create-t3-app#59

Closed

balazsorban44 changed the title ~~breaking: replace openid-client with oauth4webapi~~ feat(core): make core optionally opt-into Web-compatible runtime mode Jun 27, 2022

balazsorban44 changed the title ~~feat(core): make core optionally opt-into Web-compatible runtime mode~~ feat(core): make next-authoptionally opt-into Web-compatible mode Jun 27, 2022

balazsorban44 changed the title ~~feat(core): make next-authoptionally opt-into Web-compatible mode~~ feat(core): make next-auth optionally opt-into Web-compatible mode Jun 27, 2022

balazsorban44 mentioned this pull request Jun 28, 2022

Add logic to pass newUserInfo when creating a new user #4747

Closed

3 tasks

balazsorban44 force-pushed the main branch from 2f7629d to c1f7ce3 Compare July 8, 2022 17:24

This was referenced Jul 11, 2022

Email requires adapter, which makes session strategy default to database. Middleware then doesn't work. #4891

Closed

Extend OAuth provider configuration object to include a token refresh handler #4902

Closed

balazsorban44 mentioned this pull request Aug 12, 2022

Make crypto usage configurable (enabling NextAuth.js to be used in Cloudlfare Workers, Vercel Edge, Deno Deploy, etc.) #5142

Closed

vercel bot temporarily deployed to Preview October 7, 2022 00:21 Inactive

balazsorban44 force-pushed the feat/oauth4webapi branch from bde0b22 to f48e0f1 Compare October 7, 2022 00:22

balazsorban44 mentioned this pull request Oct 10, 2022

feat(web): expose Web API compatible version of next-auth #5536

Merged

4 tasks

balazsorban44 closed this Oct 10, 2022

ThangHuuVu deleted the feat/oauth4webapi branch October 15, 2022 07:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(core): make `next-auth` optionally opt-into Web-compatible mode #4299

feat(core): make `next-auth` optionally opt-into Web-compatible mode #4299

ThangHuuVu commented Apr 1, 2022 •

edited

Loading

vercel bot commented Apr 1, 2022 •

edited

Loading

ThangHuuVu Apr 1, 2022

balazsorban44 Apr 5, 2022

balazsorban44 Apr 5, 2022

ThangHuuVu Apr 1, 2022

ThangHuuVu Apr 1, 2022 •

edited

Loading

balazsorban44 Apr 5, 2022

ThangHuuVu Apr 1, 2022 •

edited

Loading

balazsorban44 Apr 5, 2022

balazsorban44 Apr 5, 2022

panva Apr 7, 2022

panva Apr 7, 2022

panva Apr 7, 2022 •

edited

Loading

ThangHuuVu Apr 7, 2022

panva Apr 7, 2022

ThangHuuVu Apr 7, 2022

panva Apr 7, 2022

ThangHuuVu Apr 7, 2022

vercel bot commented Jun 10, 2022 •

edited

Loading

david58 commented Oct 5, 2022

ThangHuuVu commented Oct 6, 2022 •

edited

Loading

balazsorban44 commented Oct 10, 2022

	code_challenge_methods_supported?.length === 0
	code_challenge_methods_supported?.includes('S256') === false

feat(core): make next-auth optionally opt-into Web-compatible mode #4299

feat(core): make next-auth optionally opt-into Web-compatible mode #4299

Conversation

ThangHuuVu commented Apr 1, 2022 • edited Loading

Reasoning 💡

Notes on using PKCE and state/nonce

Checklist 🧢

Affected issues 🎟

References

vercel bot commented Apr 1, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ThangHuuVu Apr 1, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ThangHuuVu Apr 1, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

panva Apr 7, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vercel bot commented Jun 10, 2022 • edited Loading

david58 commented Oct 5, 2022

ThangHuuVu commented Oct 6, 2022 • edited Loading

balazsorban44 commented Oct 10, 2022

feat(core): make `next-auth` optionally opt-into Web-compatible mode #4299

feat(core): make `next-auth` optionally opt-into Web-compatible mode #4299

ThangHuuVu commented Apr 1, 2022 •

edited

Loading

vercel bot commented Apr 1, 2022 •

edited

Loading

ThangHuuVu Apr 1, 2022 •

edited

Loading

ThangHuuVu Apr 1, 2022 •

edited

Loading

panva Apr 7, 2022 •

edited

Loading

vercel bot commented Jun 10, 2022 •

edited

Loading

ThangHuuVu commented Oct 6, 2022 •

edited

Loading