search

atinux / nuxt-auth-utils

Add Authentication to Nuxt applications with secured & sealed cookies sessions.
MIT License
973 stars 91 forks source link

Include All JWT Properties in OAuth onSuccess Data #270

Closed kbarnesMCC closed 1 week ago

kbarnesMCC commented 2 weeks ago

Currently the onSuccess() handler for OAuth support exposes user and tokens attributes; where the details under user are a subset of the JWT decoded details from tokens.id_token.

Wondering if it would be possible to instead allow consumers to obtain ALL JWT decoded properties from tokens.id_tokens?

This would allow consumers to avoid a secondary call to decode the JWT to obtain things like sid (which are used for RP-initiated logout requests for some providers).

atinux commented 1 week ago

What OAuth provider are you using exactly?

kbarnesMCC commented 1 week ago

We're using Auth0.

Currently the specific property we're looking to obtain is sid for RP-initiated logout. That said, there's a number of properties that tend to get injected at the root for JWTs, hence why it might be beneficial to just have access to what you've already decoded.

atinux commented 1 week ago

Actually the user comes from this: https://github.com/atinux/nuxt-auth-utils/blob/065c54dba8e2b06b356de421bca4a91881158a4f/src/runtime/server/lib/oauth/auth0.ts#L126-L130

kbarnesMCC commented 1 week ago

I see, interesting; so you don't decode/validate the JWT in any capacity you're just passing it through.

Ok, well consider this one closed; I misunderstood what was happening under the hood!