Authorization Flow Issues

[summer-cook]

story

occasionally, when logging in to the phenovista marketplace from their digital storefront, the user is redirected to the next auth sign in page instead of routing them directly to the marketplace. the behavior in the screenshot below is what happens when the provider's id isn't passed to the signIn method. we are passing it however, so debugging needs to be done to see why we aren't bypassing the nextauth sign in page.

Digital storefront user journey:
https://docs.google.com/document/d/1nNvUxzInahqMrVZWGCyVnskmJvMo4c1k5oqKwwSYvIY/edit

screenshots

resources

• https://next-auth.js.org/getting-started/client#signin

notes

• normally, this page could show multiple sign in methods (i.e. - sign in with google, facebook etc) but in our case, we should only have the option to sign in with the provider.
• this page should never show - because we are passing the provider ID in our sign in method. we don't want to see it because we only have one sign in method.
• this page should always be bypassed but sometimes it gets sent there - but its not a consistent issue.
• https://github.com/scientist-softserv/webstore/blob/main/pages/_app.js#L47 - where we are passing the provider name.

[alishaevn]

I was just able to duplicate this issue. I went to https://store.phenovista.com/, but when I pressed the "sign in" button, it redirected me to https://phenovista.softserv.cloud/api/auth/signin?error=OAuthCallback. this probably has something to do with the fact that the site is actually deployed to https://phenovista.softserv.cloud. their cname of https://store.phenovista.com/ point there, so the callback redirect is most likely the problem.

clicking "sign in with phenovista" did sign me in properly.

ref: slack thread around dns and cname.

[alishaevn]

I tested this again by signing into phenovista.scientist.com, and disallowing access to the DS in my settings. I then went back to https://store.phenovista.com/ and tried to sign in. it took me to the phenovista store front to grant access to the DS. I selected "allow" but didn't have it remember my decision, which redirected me to https://phenovista.softserv.cloud/api/auth/signin?error=OAuthCallback, the softserv dns. this time, pressing "sign in with phenovista" took me back to the phenovista storefront once more. after pressing "allow" again, it redirected me to phenovista.softserv.cloud and NOT store.phenovista.com.

this is definitely a redirect problem. will have to research to see how to get around it.

[alishaevn]

potential clues:

• https://next-auth.js.org/configuration/callbacks#redirect-callback
• https://next-auth.js.org/getting-started/rest-api#getpost-apiauthcallbackprovider
• https://next-auth.js.org/configuration/providers/oauth#using-a-custom-provider
• OAUTH_CALLBACK_ERROR State cookie was missing nextauthjs/next-auth#7491 (comment)
• use next-auth on a subdomain as a separated authentication service nextauthjs/next-auth#1299 (comment)
• https://stackoverflow.com/a/77742170/8079848

[alishaevn]

crystal suggested in stand up that this issue might be able to be fixed from the devops side. started a thread for possible suggestions.