Closed codetheorist closed 1 year ago
Hi @codetheorist,
We have looked into this issue before and sadly it is one resulting from our parent package NextAuth. Therefore we sadly have little control over how they handle the splitting and which urls they enable for certain provders.
Environment
Build Modules: -
Reproduction
Core issue, no repro required.
Describe the bug
When using OpenID Connect, I have a lot of data in my tokens. Instead of using the data from the tokens, I would like to be able to fetch the data from a user info endpoint, which is completely disabled if an OpenID Connect response contains an ID token. If you try to disable the
idToken
functionality in the provider, then the authentication module throws an error and is unable to use the user info endpoint.Additional context
The reason for this is there are many issues with large JWT tokens, such as having to split the token over multiple cookies when storing. This leads to further issues when trying to re-join the cookies, which can join out-of-order.
Another reason for this is to allow the web/native app to check for updated roles & permission independently of updating the use token. This would further allow the users permissions response to contain only a sub-set of the roles required for the particular area of the app the user is visiting.
Logs
No response