Open danilopeixoto opened 10 months ago
As of 5.0.0-beta.18, token.request
function in auth options is ignored :(
client_id and client_secret are by passed as http basic auth header. However, you can change this behaviour by using client.token_endpoint_auth_method parameter.
token: {
url: '...',
},
client: {
token_endpoint_auth_method: 'none', // only client_id added to to body
token_endpoint_auth_method: 'client_secret_post', // both client_id and client_secret added to body
},
Environment
Reproduction URL
https://github.com/nextauthjs/next-auth-example
Describe the issue
The panva/node-openid-client will not use the custom token parameters set by
next-auth
as in packages/next-auth/src/core/lib/oauth/callback.ts:Possible solution
We found a solution using
exchangeBody
argument, however, this requires investigation to confirm this is safe for OAuth2 protocol.How to reproduce
Inject custom parameters to tokens:
The parameters will not be injected in the body of requests and an error will be returned by custom provider:
Expected behavior
The token parameters should be added to request body for custom providers and
Missing client_id
error should not be returned by provider.