Replies: 18 comments 41 replies
-
Beta Was this translation helpful? Give feedback.
-
|
Hi David, thanks for your reply. Just had another look at my scopes, they all seem to match across the user pool, provider config and IDP authorised scopes. I am using Google as a 3rd party IDP for Cognito requesting 'openid profile email'. Any other ideas? |
Beta Was this translation helpful? Give feedback.
-
|
Apologies, the issue is unrelated to auth scopes. Its still happening for me when first completing the oauth flow. However, if I run the flow again, it completes ok and I get a valid session. I'm using cognito with apple sign in. |
Beta Was this translation helpful? Give feedback.
-
|
I am also facing this problem, I already check my scopes and it's ok too. I'm also using Google and I noticed that in the first auth, when Google ask me for my credentials is when its happening, but if I sign out and sign in again, Google doesn't ask me because I already authenticated to it before, so the problem doesn't occur |
Beta Was this translation helpful? Give feedback.
-
|
Ditto. I've been running next-auth@4.0.0-beta.3 for months now and I had my Cognito setup all working. Today I decided to upgrade to 4.0.6 and I'm getting the same errors as the individuals above. ^^ Maybe a diff between 4.0.6 and the 4.0.0-beta.3 may pin point the issue. |
Beta Was this translation helpful? Give feedback.
-
|
I too am seeing this issue with Cognito. I've rolled back to 4.0.0-beta.3 for now as the latest functional build. 4.0.0-beta-4 introduces an update to the 'openid-client' package from ^4.7.4 to ^5.0.1 (although beta-4 is broken and fixed in beta-5) and now ^5.1.0. It seems openid-client 5.0.1 forced id token validation (client.callback() instead of client.oauthCallback()) and the nonce check in openid-client. You can trigger the same validation by setting idToken true in your next-auth config for Cognito on 4.0.0-beta.3 (becoming the default from beta-5. Cognito seems to generate the nonce for the initial auth when using an IDP which triggers the error on callback. Beyond that, I'm stumped! |
Beta Was this translation helpful? Give feedback.
-
|
I'm getting exactly the same error message in my project which uses openid-client in a Remix app. What I can't tell is if this is a bug in Cognito or a bug in openid-client. |
Beta Was this translation helpful? Give feedback.
-
|
Aha! I figured out a workaround for my code, which may work for next-auth too. Unfortunately my code isn't public (yet) so I can only provide a snippet here. In the call to const tokenSet = await client.callback(getRedirectUri(request), params, {
code_verifier,
nonce: null // <-- add this
}) |
Beta Was this translation helpful? Give feedback.
-
I am using PKCE with Cognito. (But I am using node-openid-client directly.) |
Beta Was this translation helpful? Give feedback.
-
Yeah, I amended the provider to add the PKCE checks, but then NextAuth throws the nonce mismatch error after. Effectively it does this: if (provider.token?.request) {
// @ts-expect-error
const response = await provider.token.request({
provider,
params,
checks,
client,
})
tokens = new TokenSet(response.tokens)
} else if (provider.idToken) {
tokens = await client.callback(provider.callbackUrl, params, checks)
} else {
tokens = await client.oauthCallback(provider.callbackUrl, params, checks)
}The checks value that gets passed to the open-id client can't be set externally and it never expects a nonce to be set in the reponse. ie. There is no means in the lib to provide the nonce value though, so if you add it to the auth url it sets it but then the check expects So assuming AWS won't budge I am wondering if we add the ability to generate or set this value when calling cognito and use this value in the check. Otherwise I don't see how anyone can use NextAuth with Cognito + and external IDP. |
Beta Was this translation helpful? Give feedback.
-
|
I don't think we currently set or use |
Beta Was this translation helpful? Give feedback.
-
|
I did consider raising a PR, the issue we have is if we define a As a naive fix it would be easy to set the nonce value in the provider config, then in the callback do something like: This could optionally behind a config in Where would you suggest that the value could be generated and stored as guessing defining it statically in the config is not ideal. |
Beta Was this translation helpful? Give feedback.
-
|
@balazsorban44 - We had a go at adding this functionality last night. Hopefully this looks reasonable. This has been added as an additional check that users can optionally enable in provider config and generates a new nonce value vs using a statically configured one. |
Beta Was this translation helpful? Give feedback.
-
|
Having the exact same issue as everyone here, errors out on first attempt at login, then works the second time. I'm new to Next-auth, really want to like it but this isn't a great first impression! |
Beta Was this translation helpful? Give feedback.
-
|
No worries. Glad it's useful for others! |
Beta Was this translation helpful? Give feedback.
-
|
Hello. I still have same issue with Cognito Adapter (with SAML Azure AD). After clicking "Sign in with Cognito" again - i have access to page. Provider settings: Container: node:14-alpine |
Beta Was this translation helpful? Give feedback.
-
|
Same problem here, next: 12.1.1 |
Beta Was this translation helpful? Give feedback.
-
|
Are you using the forked version of the code with this fix in it? The PR is not yet merged and has been readied for review in the next release. |
Beta Was this translation helpful? Give feedback.
-
|
Oh, i see. I thought it is already merged. I've used latest release version. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the effort @james-bjss . We are also affected by this issue, I'll try your forked version to see if it addresses the issue. I'm mostly posting to add more interest on this fix being merged 😃 |
Beta Was this translation helpful? Give feedback.
-
I'm must be missing something, I did checkout your branch @james-bjss and run |
Beta Was this translation helpful? Give feedback.
-
|
@jamesbluecrow Use this patch instead and place into You'll need to install this package from npm patch-package. Finally, ensure you have the following script in your package.json scripts: Next time you run |
Beta Was this translation helpful? Give feedback.
-
|
@lluia @balazsorban44 Can you help us ? PR is here : #4100 |
Beta Was this translation helpful? Give feedback.
-
Aaand it's merged! 🎉 Thanks all. |
Beta Was this translation helpful? Give feedback.
-
|
Created a patch for version 4.10.3 if it's of help to anyone next-auth+4.10.3.patch. |
Beta Was this translation helpful? Give feedback.
-
|
I have the latest package with this fix in it at Correct me if I'm wrong but I believe you also need to add this to your provider config? checks: 'nonce', |
Beta Was this translation helpful? Give feedback.
-
|
Correct, there are other checks so you may want to append this to the existing ones. Namely the state and pkce options (can check the source for your given provider to see the defaults). type ChecksType = "pkce" | "state" | "none" | "nonce" |
Beta Was this translation helpful? Give feedback.
-
|
What checks should be used with cognito? |
Beta Was this translation helpful? Give feedback.
-
pkce, state, nonce |
Beta Was this translation helpful? Give feedback.
-
|
Hi @james-bjss I am using the latest version 4.10.3 but it is not working. Do I need to perform some extra steps to apply this fix? |
Beta Was this translation helpful? Give feedback.
-
The fix has been merged to main but there has been no new release since. You would need to apply the patch package as per convos above until the next nextauth release with the fix in it. There is a flurry of chore activity on main at the moment from the maintainers and it looks like they may be prepping for a new release? So if you can wait it out the new package should be out eventually... |
Beta Was this translation helpful? Give feedback.
-
|
Ah ok noted that!
Thank you very much for the info, I will use the patch for now.
Cheers,
Ronaldwh
…On Sat, Sep 10, 2022, 6:17 PM James ***@***.***> wrote:
Hi @james-bjss <https://github.com/james-bjss>
I am using the latest version 4.10.3 but it is not working. Do I need to
perform some extra steps to apply this fix?
The fix has veen merged to main but there has been no new release since.
You would need to apply the patch package as per convos above until the
next nextauth release with the fix in it.
There is a flurry of chore activity on main at the mo from the maintainers
and looks like they may be prepping for a new release, so if you can wait
the new package should be out eventually.
—
Reply to this email directly, view it on GitHub
<#3551 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AFS4MIILFSVIIRBZWRRZ5FDV5RN3FANCNFSM5LGUO74A>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
This is now released, though seems absent form the release notes. Can confirm its working for us without the patch on the latest release. |
Beta Was this translation helpful? Give feedback.
-
|
I'm currently on version 4.1.2 and still receiving this issue. Is there something in particular I'm missing? The error is: To be clear, I'm currently using the Cognito Logout URL to force Google to show the account selection screen again. This occurs when I swap accounts. |
Beta Was this translation helpful? Give feedback.
-
|
I'm running the same behavior with: "next": "^13.0.5",
"next-auth": "^4.17.0",Error: MyProvider: import NextAuth from "next-auth";
import CognitoProvider from "next-auth/providers/cognito";
export default NextAuth({
providers: [
// https://github.com/nextauthjs/next-auth/discussions/3551
CognitoProvider({
clientId: process.env.COGNITO_CLIENT_ID,
clientSecret: process.env.COGNITO_CLIENT_SECRET,
issuer: process.env.COGNITO_ISSUER,
idToken: true,
checks: 'nonce',
}),
],
callbacks: {
// By default NextAuth will redirect to an url of the same hostname
// this callback allows to change that behavior and specify a custom url
redirect({ url }) {
return url;
},
async session({ session, token }) {
// Send properties to the client, like an access_token from a provider.
session.customerID = token.sub;
return session;
},
},
secret: process.env.SECRET,
debug: process.env.NODE_ENV === "development",
}); |
Beta Was this translation helpful? Give feedback.
-
|
Was able to fix the issue using the My config: @leonp-s I spent quite a while searching through this thread to eventually find the right solution, maybe one of these comments linking to #4100 can be marked as the correct answer? |
Beta Was this translation helpful? Give feedback.
-
|
Alright, I had it come back in the case where I have a NextAuth session, but not a Cognito session. I don't think my users will face this case though. |
Beta Was this translation helpful? Give feedback.
-
|
I'm having the same issue: #6865 |
Beta Was this translation helpful? Give feedback.
-
|
I am having the same issue too, I am using version 4.22.1 |
Beta Was this translation helpful? Give feedback.
-
|
I have That fixes things for me as long as I set |
Beta Was this translation helpful? Give feedback.
-
|
cheers @half2me I can't really patch it, so decided to go with overriding the checks to nonce only and it worked like a charm |
Beta Was this translation helpful? Give feedback.
-
Keep it mind that will only work for normal username/password logins. If you try to use social login with cognito (login with facebook, google, etc.) it will give you an error. |
Beta Was this translation helpful? Give feedback.
-
|
Should we perhaps add the fix as a default in https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/cognito.ts#LL91C10-L91C10 ? options: { checks: "nonce", ...options } |
Beta Was this translation helpful? Give feedback.
-
|
it doesn't fix the problem though. If you use "social login" with cognito, it still gives you the same error |
Beta Was this translation helpful? Give feedback.
-
|
works on my side for an azure active directory login... |
Beta Was this translation helpful? Give feedback.
-
|
This same exact nonce mismatch error with |
Beta Was this translation helpful? Give feedback.
and others
Uh oh!
There was an error while loading. Please reload this page.
-
Question 💬
I am currently trying to use AWS Cognito (setup with a third party IDP) however I am running into an issue when signing in with a third party IDP via Cognito.
A similar question has been asked here, and has been closed however I was hoping a solution might be proposed.
How to reproduce ☕️
Contributing 🙌🏽
Yes, I am willing to help answer this question in a PR
Beta Was this translation helpful? Give feedback.
All reactions