Backend JWE Decryption / Validation

[MrT3313]

Hello Next-Auth,

I am attempting to implement Next-Auth w/ the Auth0Provider but there is no clear explanation on how to pass the DECODED access_token to the backend for validation. I am seeing some posts referencing the getToken helper function & others referencing overriding the encode & decode methods but both of these are used on the frontend.

I know this has to do with next-auth encoding JWTs as JWEs but what am i missing in terms of a pretty standard flow of decoding & passing an access_token to an API service? What is the recommended way to let next-auth integrate with a backend API?

I have a full SO Post outlining my issue.

---

Below is my current authOptions for next-auth (I do NOT currently have the encode & decode overwritten)

const authOptions = {
    providers: [
      Auth0Provider({
        clientId: process.env.AUTH0_CLIENT_ID,
        clientSecret: process.env.AUTH0_CLIENT_SECRET,
        issuer: process.env.AUTH0_ISSUER,
        idToken: true,
      }),
    ],

    callbacks: {
      // The JWT callback is called any time a token is written to
      async jwt({ token, user, account, profile, isNewUser }) {
        if (account) {
          token.access_token = account.access_token;
          token.id_token = account.id_token;
          token.auth0_id = token.sub;
          token.type = account.token_type;
        }
        delete token.name;
        delete token.picture;
        delete token.sub;
        return token;
      },

      // The session callback is called before a session object is returned to the client
      async session({ session, user, token }) {
        const newSession = {
          user: {
            auth0_id: token.auth0_id,
            email: token.email,
          },
          token: {
            access_token: token.access_token,
            id_token: token.id_token,
            token_type: token.type,
          },
        };
        return newSession;
      },
    },

    secret: process.env.NEXTAUTH_SECRET,
  };

export default (req, res) => NextAuth(req, res, authOptions);

I have also copied the middleware validator that I am using in my Express Server directly from the Auth0 quick start into my Express Backend Server

import { expressjwt } from "express-jwt";
import jwks from "jwks-rsa";

const validator = expressjwt({
  secret: jwks.expressJwtSecret({
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: "https://dev-<REDACTED>.us.auth0.com/.well-known/jwks.json",
  }),
  audience: "thunderbolt",
  issuer: "https://dev-<REDACTED>.us.auth0.com/",
  algorithms: ["RS256"],
});

The Server Error

UnauthorizedError: jwt malformed
    at new UnauthorizedError (/Users/mrt/Documents/MrT/code/M/bolt/node_modules/express-jwt/dist/errors/UnauthorizedError.js:22:28)
    at /Users/mrt/Documents/MrT/code/M/bolt/node_modules/express-jwt/dist/index.js:133:35
    at step (/Users/mrt/Documents/MrT/code/M/bolt/node_modules/express-jwt/dist/index.js:33:23)
    at Object.next (/Users/mrt/Documents/MrT/code/M/bolt/node_modules/express-jwt/dist/index.js:14:53)
    at fulfilled (/Users/mrt/Documents/MrT/code/M/bolt/node_modules/express-jwt/dist/index.js:5:58)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)

Thank you for any help on this!

[JimmyAG]

Just came across this issue while integrating nextjs v14 with express backend
This comment helped me figure it out

For my solution I added the accessToken and the refreshToken that I get in the response after calling the login endpoint to the jwt callback (the object itself is called user)

async jwt({ token, trigger, user, session }) {
      if (user) {
        const customUser = user as unknown as {
          token: string
          refreshToken: string
          email: string
          firstName: string
          lastName: string
        }

        token.accessToken = customUser.token
        token.refreshToken = customUser.refreshToken
        token.email = customUser.email
        token.firstName = customUser.firstName
        token.lastName = customUser.lastName
      }
      return token
    },

This will be the contents of the ['next-auth.session-token'], that is sent with each request (given that you used credentials: 'include' on your fetch

and in your backend you can use a function like this as suggested in the comment response of Harshit Mishra on stack overflow
however If you are using nextauth v4 or newer I don't think you need to pass the salt attribute to the function

here is mine:

const decodeJWE = async (token: string) => {
    try {
        const { decode } = await import('next-auth/jwt')

        const decodedJWE= await decode({
            token: token,
            secret: process.env.NEXTAUTH_SECRET,
        })

        return decodedJWE.accessToken as string
    } catch (error) {
        throw error
    }
}

This worked for me! it might not be the best, but it gets the job done!