Custom OAuth 2.0 Provider with PKCE not working? (Laravel Passport)

[abbluiz]

Question 💬

Hi, I am trying locally test OAuth 2.0 authentication through a local Laravel Passport server (OAuth 2.0) with PKCE. I am receiving the error "cookie code_verifier not found" when the authorization flow redirects back to nextauth app. Any ideas?

Authorization Code grant with PKCE is supported by Laravel Passport. Here's my provider configuration:

const options = {
  providers: [
    {
      id: 'userh-account',
      name: 'UseRH Account',
      type: 'oauth',
      version: '2.0',
      scope: '',
      params: { grant_type: 'authorization_code' },
      accessTokenUrl: process.env.USERH_AUTHZ_SERVER_ORIGIN + '/oauth/token',
      requestTokenUrl: process.env.USERH_AUTHZ_SERVER_ORIGIN + '/oauth/token',
      authorizationUrl:
        process.env.USERH_AUTHZ_SERVER_ORIGIN +
        '/oauth/authorize?response_type=code',
      profileUrl: process.env.USERH_AUTHZ_SERVER_ORIGIN + '/api/user',
      async profile(profile, tokens) {
        return {
          ...profile,
          tokens
        }
      },
      clientId: process.env.USERH_AUTHZ_CLIENT_ID,
      protection: 'pkce',
    },
  ],

  session: {
    jwt: true,
  },

  jwt: {},

  pages: {},

  callbacks: {},

  events: {},

  theme: 'light',

  debug: true,
}

How to reproduce ☕️

1. Authz server is running locally on port 80 and nextauth is running locally on port 3000
2. Nextauth redirects to authorization flow, I login through authz, redirects back to nextauth with "The code_verifier cookie was not found."

Contributing 🙌🏽

No, I am afraid I cannot help regarding this

[balazsorban44]

The error originates from here:

next-auth/src/server/lib/oauth/pkce-handler.js

Line 25 in e8a58a0

throw new OAuthCallbackError('The code_verifier cookie was not found.')

The code_verifier is saved in a secure cookie temporarily:

next-auth/src/server/lib/oauth/pkce-handler.js

Lines 84 to 87 in e8a58a0

	cookie.set(res, cookies.pkceCodeVerifier.name, encryptedCodeVerifier, {
	expires: cookieExpires.toISOString(),
	...cookies.pkceCodeVerifier.options
	})

Make sure that you have cookies enabled. Also, note that the code_verifier cookie has a lifetime of 15 minutes:

next-auth/src/server/lib/oauth/pkce-handler.js

Line 9 in e8a58a0

const PKCE_MAX_AGE = 60 * 15 // 15 minutes in seconds

After that, the user has to try to log in again.

[abbluiz]

Thank you for your answer. I am still debugging this issue, however I know it's not the 15 minutes lifetime.

Is the authz server responsible to send this cookie back to nextauth?

[balazsorban44]

we set this cookie just before we redirect the user to the authorization endpoint, and we delete it after it has been used

[abbluiz]

So the authorization server must send the cookie back? Maybe the problem lies there

[balazsorban44]

See:

https://auth0.com/docs/authorization/flows/authorization-code-flow-with-proof-key-for-code-exchange-pkce

https://oauth.net/2/pkce/

[abbluiz]

Nevermind. This is an issue with Inertia.js on the Authorization Server (Larevel Passport + Laravel Fortify + Inertia). For anyone with the same issue, there are problems with Inertia redirecting to external URIs.

Thank you for your answers!