search

nextauthjs / next-auth

Authentication for the Web.
https://authjs.dev
ISC License
23.78k stars 3.27k forks source link

Missing client_secret error when trying to use a public client #8728

Closed pozsa closed 10 months ago

pozsa commented 10 months ago

Environment

  System:
    OS: Linux 5.15 Debian GNU/Linux 11 (bullseye) 11 (bullseye)
    CPU: (8) x64 Intel(R) Core(TM) i5-10310U CPU @ 1.70GHz
    Memory: 9.52 GB / 15.39 GB
    Container: Yes
    Shell: 5.1.4 - /bin/bash
  Binaries:
    Node: 18.16.1 - /usr/local/bin/node
    Yarn: 1.22.19 - /usr/local/bin/yarn
    npm: 9.5.1 - /usr/local/bin/npm
{
    "name": "aof",
    "version": "0.0.1",
    "private": true,
    "scripts": {
        "dev": "vite dev",
        "build": "vite build",
        "preview": "vite preview",
        "test": "npm run test:integration && npm run test:unit",
        "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
        "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
        "lint": "prettier --plugin prettier-plugin-svelte --check . && eslint .",
        "format": "prettier --plugin prettier-plugin-svelte --write .",
        "test:integration": "playwright test",
        "test:unit": "vitest"
    },
    "dependencies": {
        "@auth/core": "0.15.1",
        "@auth/sveltekit": "0.3.7"
    },
    "devDependencies": {
        "@playwright/test": "1.37.1",
        "@skeletonlabs/skeleton": "1.11.0",
        "@sveltejs/adapter-auto": "2.1.0",
        "@sveltejs/kit": "1.24.1",
        "@typescript-eslint/eslint-plugin": "6.7.2",
        "@typescript-eslint/parser": "6.7.2",
        "autoprefixer": "10.4.15",
        "eslint": "8.49.0",
        "eslint-config-prettier": "9.0.0",
        "eslint-plugin-svelte": "2.33.2",
        "postcss": "8.4.30",
        "prettier": "3.0.3",
        "prettier-plugin-svelte": "3.0.3",
        "svelte": "4.2.0",
        "svelte-check": "3.5.2",
        "tailwindcss": "3.3.3",
        "tslib": "2.6.2",
        "typescript": "5.2.2",
        "vite": "4.4.9",
        "vitest": "0.34.4"
    },
    "type": "module",
    "prettier": {
        "useTabs": true,
        "singleQuote": true,
        "trailingComma": "none",
        "printWidth": 88,
        "plugins": [
            "prettier-plugin-svelte"
        ],
        "overrides": [
            {
                "files": "*.svelte",
                "options": {
                    "parser": "svelte"
                }
            }
        ]
    }
}

Reproduction URL

na

Describe the issue

[auth][error][CallbackRouteError]: Read more at https://errors.authjs.dev#callbackrouteerror
[auth][cause]: TypeError: "client.client_secret" property must be a non-empty string
    at assertClientSecret (file:///home/node/aof/node_modules/oauth4webapi/build/index.js:380:15)
    at clientAuthentication (file:///home/node/aof/node_modules/oauth4webapi/build/index.js:402:78)
    at authenticatedRequest (file:///home/node/aof/node_modules/oauth4webapi/build/index.js:823:11)
    at tokenEndpointRequest (file:///home/node/aof/node_modules/oauth4webapi/build/index.js:844:12)
    at Module.authorizationCodeGrantRequest (file:///home/node/aof/node_modules/oauth4webapi/build/index.js:990:12)
    at handleOAuth (file:///home/node/aof/node_modules/@auth/sveltekit/node_modules/@auth/core/lib/oauth/callback.js:57:37)
    at async Module.callback (file:///home/node/aof/node_modules/@auth/sveltekit/node_modules/@auth/core/lib/routes/callback.js:20:41)
    at async AuthInternal (file:///home/node/aof/node_modules/@auth/sveltekit/node_modules/@auth/core/lib/index.js:65:38)
    at async Proxy.Auth (file:///home/node/aof/node_modules/@auth/sveltekit/node_modules/@auth/core/index.js:100:30)
    at async Module.respond (/home/node/aof/node_modules/@sveltejs/kit/src/runtime/server/respond.js:282:20)
[auth][details]: {
  "provider": "eduid"
}

How to reproduce

import { SvelteKitAuth } from '@auth/sveltekit';

export const handle = SvelteKitAuth({
    providers: [
        {
            id: 'eduid',
            name: 'SWITCH edu-ID',
            type: 'oidc',
            issuer: 'https://login.test.eduid.ch/',
            clientId: '<your-provider>',
            checks: ['pkce']
        }
    ]
});

Expected behavior

A missing client_secret should not be an error when a public client is used, because there is no client secret in that scenario.

github-actions[bot] commented 10 months ago

We could not detect a valid reproduction link. Make sure to follow the bug report template carefully.

Why was this issue closed?

To be able to investigate, we need access to a reproduction to identify what triggered the issue. We need a link to a public GitHub repository. Example: (NextAuth.js example repository).

The bug template that you filled out has a section called "Reproduction URL", which is where you should provide the link to the reproduction.

What should I do?

Depending on the reason the issue was closed, you can do the following:

In general, assume that we should not go through a lengthy onboarding process at your company code only to be able to verify an issue.

My repository is private and cannot make it public

In most cases, a private repo will not be a sufficient minimal reproduction, as this codebase might contain a lot of unrelated parts that would make our investigation take longer. Please do not make it public. Instead, create a new repository using the templates above, adding the relevant code to reproduce the issue. Common things to look out for:

I did not open this issue, but it is relevant to me, what can I do to help?

Anyone experiencing the same issue is welcome to provide a minimal reproduction following the above steps by opening a new issue.

I think my reproduction is good enough, why aren't you looking into it quickly?

We look into every issue and monitor open issues for new comments.

However, sometimes we might miss a few due to the popularity/high traffic of the repository. We apologize, and kindly ask you to refrain from tagging core maintainers, as that will usually not result in increased priority.

Upvoting issues to show your interest will help us prioritize and address them as quickly as possible. That said, every issue is important to us, and if an issue gets closed by accident, we encourage you to open a new one linking to the old issue and we will look into it.

Useful Resources