Skip to content

fix(auth): use web app credentials for mobile ROPG refresh #1444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
clintonlunn merged 1 commit into from
Jan 14, 2026
Merged

fix(auth): use web app credentials for mobile ROPG refresh #1444

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions src/Config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ interface AUTH_CONFIG_SERVER_TYPE {
issuer: string
clientId: string
clientSecret: string
mobileClientId: string
mgmtClientId: string
mgmtClientSecret: string
mgmtClientAudience: string
Expand All @@ -26,7 +25,6 @@ if (typeof window === 'undefined') {
issuer: checkAndPrintWarning('AUTH0_DOMAIN', process.env.AUTH0_DOMAIN),
clientId: checkAndPrintWarning('AUTH0_CLIENT_ID', process.env.AUTH0_CLIENT_ID),
clientSecret: checkAndPrintWarning('AUTH0_CLIENT_SECRET', process.env.AUTH0_CLIENT_SECRET),
mobileClientId: checkAndPrintWarning('AUTH0_MOBILE_CLIENT_ID', process.env.AUTH0_MOBILE_CLIENT_ID),
mgmtClientId: checkAndPrintWarning('AUTH0_MGMT_CLIENT_ID', process.env.AUTH0_MGMT_CLIENT_ID),
mgmtClientSecret: checkAndPrintWarning('AUTH0_MGMT_CLIENT_SECRET', process.env.AUTH0_MGMT_CLIENT_SECRET),
mgmtClientAudience: checkAndPrintWarning('AUTH0_MGMT_CLIENT_AUDIENCE', process.env.AUTH0_MGMT_CLIENT_AUDIENCE),
Expand Down
13 changes: 4 additions & 9 deletions src/js/auth/mobile.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,18 +4,13 @@ import { AUTH_CONFIG_SERVER } from '../../Config'

if (AUTH_CONFIG_SERVER == null) throw new Error('AUTH_CONFIG_SERVER not defined')

const mobileAuthSecret = process.env.MOBILE_AUTH_SECRET
if (mobileAuthSecret == null) {
console.warn('Mobile auth secret not found')
}

const { mobileClientId, issuer } = AUTH_CONFIG_SERVER
const { clientId, clientSecret, issuer } = AUTH_CONFIG_SERVER

// Set up Auth0 client for mobile with client secret for ROPG flow
// Set up Auth0 client for mobile ROPG using web app credentials (confidential client)
export const auth0Client = new Auth0.AuthenticationClient({
domain: issuer.replace('https://', ''),
clientId: mobileClientId,
clientSecret: mobileAuthSecret
clientId,
clientSecret
})

export const isNullOrEmpty = (str: string | null | undefined): boolean => {
Expand Down
Loading