Closed WhyAsh5114 closed 8 months ago
I also encountered this issue while trying to use @auth/core
with SvelteKit. After digging around, it seems like an issue with the dependency oauth4webapi
used by @auth/core
. In the patch release v2.4.2
, oauth4webapi
seems to have changed the way it encodes the client ID and secret while obtaining the OAuth token, as seen in commit https://github.com/panva/oauth4webapi/commit/f926175cdf6caa467029a57e76375054fff7c57b. This seems to break Google completely because Google's client ID contains -
s and .
s. Reading through the RFC6749 section 2.3.1, it seems like this is might be correct as the referenced HTML 4.01 spec states that
Non-alphanumeric characters are replaced by `%HH', a percent sign and two hexadecimal digits representing the ASCII code of the character
which includes -
and .
. Since I'm relatively inexperienced with OAuth, I'm probably wrong, but here are just my two cents.
Appreciate the deep dive @HereIsKevin! I'll look into this
I've reverted the fixes, just run npm upgrade
, as pointed out the fix is correct but unfortunately it's the server implementations that lack conformance in this regard.
I was in the middle of creating an issue about this too, glad I found this one before submitting. I first discovered it while using AuthJS Nuxt, but made a reproduction based on the nextjs example template as well. Will try out what has already been mentioned in this thread.
Edit: Upgraded dependencies and we're back in business! Thanks @panva for the quick fix!
Closing as this has been fixed upstream. It's a shame that Google is not spec-compliant. 😢
In the future major revisions of openid-client and oauth4webapi I will reinstate the correct behaviour so I advise this project to use the client_secret_post client authentication scheme for the affected providers until they fix their implementation.
Same of #9554.
The problem was the version of the openid-client
package: reinstalling force to update it at 5.6.4
version that fix the invalid client issue.
I had a similar problem using bun install
as the package manager. If I use yarn install
it works fine.
[next-auth][error][OAUTH_CALLBACK_ERROR]
https://next-auth.js.org/errors#oauth_callback_error invalid_client (The OAuth client was not found.) {
error: OPError: invalid_client (The OAuth client was not found.)
at processResponse (/Users/****/app-name/node_modules/openid-client/lib/helpers/process_response.js:38:13)
at Client.grant (/Users/****/app-name/node_modules/openid-client/lib/client.js:1354:22)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Client.callback (/Users/****/app-name/node_modules/openid-client/lib/client.js:493:24)
at async oAuthCallback (/Users/****/app-name/node_modules/next-auth/core/lib/oauth/callback.js:109:16)
at async Object.callback (/Users/****/app-name/node_modules/next-auth/core/routes/callback.js:52:11)
at async AuthHandler (/Users/****/app-name/node_modules/next-auth/core/index.js:208:28)
at async NextAuthApiHandler (/Users/****/app-name/node_modules/next-auth/next/index.js:22:19)
at async NextAuth._args$ (/Users/****/app-name/node_modules/next-auth/next/index.js:108:14)
at async /Users/****/app-name/node_modules/@sentry/nextjs/cjs/common/wrapApiHandlerWithSentry.js:133:37 {
name: 'OAuthCallbackError',
code: undefined
},
providerId: 'google',
message: 'invalid_client (The OAuth client was not found.)'
}
I've struggled with the problem, errors is quite confusing
Resolves this issue
"pnpm": {
"overrides": {
"oauth4webapi": "2.4.3"
}
}
Please read the comments above. https://github.com/nextauthjs/next-auth/issues/9558#issuecomment-1879624021 You don't need overrides
. That would make you stuck on 2.4.3
and not get updates in the future.
Provider type
Google
Environment
Reproduction URL
https://github.com/WhyAsh5114/authjs-google-v19.1
Describe the issue
Google provider breaks in
@auth/core v0.19.1
, works fine inv0.19.0
. Issue only present in Google provider AFAIK, checked GitHub, which is working in both versions.Try logging in, throws this error, only Google provider, only @auth/core 0.19.1
How to reproduce
Try logging in with the latest versions of @auth/core and sveltekit, should throw a CallbackRouteError
Expected behavior
Should login normally like the other providers do (checked GitHub)