israx
commented
1 year ago Hello @cezarcarvalhaes . Sorry that you are experiencing this issue. Can you share the oauth2/token requests for the first and second login attempt ?
E.g. Login for the first (no cognito session created)
POST https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/token
Content-Type='application/x-www-form-urlencoded'&
Authorization=Basic ZGpjOTh1M2ppZWRtaTI4M2V1OTI4OmFiY2RlZjAxMjM0NTY3ODkw
grant_type=authorization_code&
client_id=1example23456789&
code=AUTHORIZATION_CODE&
code_verifier=CODE_VERIFIER&
redirect_uri=com.myclientapp://myclient/redirect Login for the second time (cognito session created)
POST https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/token
Content-Type='application/x-www-form-urlencoded'&
Authorization=Basic ZGpjOTh1M2ppZWRtaTI4M2V1OTI4OmFiY2RlZjAxMjM0NTY3ODkw
grant_type=authorization_code&
client_id=1example23456789&
code=AUTHORIZATION_CODE&
redirect_uri=com.myclientapp://myclient/redirect You can omit values assigned to the parameters. I'd like to see how the requests are sent when login for the 1st vs 2nd time.
The invalid_request param is returned when the request was malformed or it was missing a required parameter.
And the invalid_grand param is returned when the code param was already consumed.
cezarcarvalhaes
Before opening, please confirm:
JavaScript Framework
Next.js
Amplify APIs
Authentication
Amplify Categories
auth
Environment information
Describe the bug
In a Next.js. client-side app: trying to authenticate via federated sign in with Google (calling
Auth.federatedSignIn({ provider: 'Google' })) is only successful if it's the user's first time logging in, or if the user has been manually signed out via the AWS Cognito Console.All other attempts fail, and when checking the network tab, there are four network attempts to the app client domain's
oauth2/tokenroute, three of which returninvalid_grantand one that returnsinvalid_request. Only one of those requests includes acode_verifierparam.If it's the user's first time logging in, or if they have been manually signed out via the console (calling
Auth.signOut()orAuth.SignOut({ global: true })won't doesn't seem to allow people to re-authenticate) the request works. However, there are still a total of four requests made tooauth2/tokenendpoint. The first request that includes acode_verifierparam succeeds and returns the access, id, and refresh tokens.I'm experiencing these results even when switching browsers and devices as well as clearing the cache.
Native sign in via username/password works without issue.
NOTE: I do have a PreSignUp lambda trigger for linking federated users to existing cognito pool users. That is working well, as I can see the identities merged onto a user after using federated for the first time. This user pool only allows admins to create users (no self-sign up). Removing this trigger did not change this experience.
Expected behavior
Reproduction steps
Code Snippet
Log output
aws-exports.js
No response
Manual configuration
Additional configuration
Mobile Device
No response
Mobile Operating System
No response
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
When the network tab, the app successfully redirects to
oauth2/authorizewhich in turn redirects to Google. Upon authenticating with google, we see a successful redirect tooauth2/idpresponsewhere the authorization code and state are then added to the query string along with the final redirect is made to my local app. From there Amplify uses the same code, state, and additional code verifier to make a request tooauth2/token.