feat: add PKCE support

package.json

@@ -50,11 +50,12 @@
     "jwt-decode": "^2.2.0",
     "nodemailer": "^6.4.16",
     "oauth": "^0.9.15",
+    "pkce-challenge": "^2.1.0",
     "preact": "^10.4.1",
     "preact-render-to-string": "^5.1.7",
     "querystring": "^0.2.0",
     "require_optional": "^1.0.1",
-    "typeorm": "^0.2.24"
+    "typeorm": "^0.2.29"
   },
   "peerDependencies": {
     "react": "^16.13.1 || ^17",
@@ -68,9 +69,9 @@
     "@prisma/client": "^2.12.0"
   },
   "devDependencies": {
-    "@babel/cli": "^7.8.4",
-    "@babel/core": "^7.9.6",
-    "@babel/preset-env": "^7.9.6",
+    "@babel/cli": "^7.12.8",
+    "@babel/core": "^7.12.9",
+    "@babel/preset-env": "^7.12.7",
     "autoprefixer": "^9.7.6",
     "babel-preset-preact": "^2.0.0",
     "cssnano": "^4.1.10",

src/server/index.js

@@ -14,6 +14,7 @@ import session from './routes/session'
 import pages from './pages'
 import adapters from '../adapters'
 import logger from '../lib/logger'
+import pkceChallenge from 'pkce-challenge'
 
 // To work properly in production with OAuth providers the NEXTAUTH_URL
 // environment variable must be set.
@@ -217,6 +218,8 @@ async function NextAuth (req, res, userSuppliedOptions) {
       redirect
     }
 
+    const pkce = options.providers[provider]?.pkce ? pkceChallenge(64) : undefined
+
     // If debug enabled, set ENV VAR so that logger logs debug messages
     if (options.debug === true) { process.env._NEXTAUTH_DEBUG = true }
 
@@ -250,7 +253,7 @@ async function NextAuth (req, res, userSuppliedOptions) {
           break
         case 'callback':
           if (provider && options.providers[provider]) {
-            callback(req, res, options, done)
+            callback(req, res, options, done, pkce?.code_verifier)
           } else {
             res.status(400).end(`Error: HTTP GET is not supported for ${url}`)
             return done()
@@ -279,7 +282,7 @@ async function NextAuth (req, res, userSuppliedOptions) {
           }
 
           if (provider && options.providers[provider]) {
-            signin(req, res, options, done)
+            signin({ req, res, options, done, codeChallenge: pkce.code_challenge })
           }
           break
         case 'signout':
@@ -297,7 +300,7 @@ async function NextAuth (req, res, userSuppliedOptions) {
               return redirect(`${baseUrl}${basePath}/signin?csrf=true`)
             }
 
-            callback(req, res, options, done)
+            callback(req, res, options, done, pkce?.code_verifier)
           } else {
             res.status(400).end(`Error: HTTP POST is not supported for ${url}`)
             return done()

src/server/lib/oauth/callback.js

@@ -13,22 +13,22 @@ import logger from '../../../lib/logger'
 
 // @TODO Refactor to use promises and not callbacks
 // @TODO Refactor to use jsonwebtoken instead of jwt-decode & remove dependancy
-export default async (req, provider, csrfToken, callback) => {
+export default async function oAuthCallback (req, provider, csrfToken, callback, codeVerifier) {
   // The "user" object is specific to apple provider and is provided on first sign in
   // e.g. {"name":{"firstName":"Johnny","lastName":"Appleseed"},"email":"[email protected]"}
   let { oauth_token, oauth_verifier, code, user, state } = req.query // eslint-disable-line camelcase
   const client = oAuthClient(provider)
 
-  if (provider.version && provider.version.startsWith('2.')) {
+  if (provider.version?.startsWith('2.')) {
     // For OAuth 2.0 flows, check state returned and matches expected value
     // (a hash of the NextAuth.js CSRF token).
     //
     // This check can be disabled for providers that do not support it by
-    // setting `state: false` as a option on the provider (defaults to true).
+    // setting `state: false` as an option on the provider (defaults to true).
     if (!Object.prototype.hasOwnProperty.call(provider, 'state') || provider.state === true) {
       const expectedState = createHash('sha256').update(csrfToken).digest('hex')
       if (state !== expectedState) {
-        return callback(new Error('Invalid state returned from oAuth provider'))
+        return callback(new Error('Invalid state returned from OAuth provider'))
       }
     }
 
@@ -87,7 +87,7 @@ export default async (req, provider, csrfToken, callback) => {
             }
           )
         } else {
-          // Use custom get() method for oAuth2 flows
+          // Use custom get() method for OAuth2 flows
           client.get = _get
 
           client.get(
@@ -100,7 +100,8 @@ export default async (req, provider, csrfToken, callback) => {
             }
           )
         }
-      }
+      },
+      codeVerifier
     )
   } else {
     // Handle oAuth v1.x
@@ -187,13 +188,17 @@ async function _getProfile (error, profileData, accessToken, refreshToken, provi
 }
 
 // Ported from https://github.com/ciaranj/node-oauth/blob/a7f8a1e21c362eb4ed2039431fb9ac2ae749f26a/lib/oauth2.js
-async function _getOAuthAccessToken (code, provider, callback) {
+async function _getOAuthAccessToken (code, provider, callback, codeVerifier) {
   const url = provider.accessTokenUrl
   const setGetAccessTokenAuthHeader = (provider.setGetAccessTokenAuthHeader !== null) ? provider.setGetAccessTokenAuthHeader : true
-  const params = { ...provider.params } || {}
+  const params = new URLSearchParams({ ...provider.params } || {})
   const headers = { ...provider.headers } || {}
   const codeParam = (params.grant_type === 'refresh_token') ? 'refresh_token' : 'code'
 
+  if (provider.pkce) {
+    params.code_verifier = codeVerifier
+  }
+
   if (!params[codeParam]) { params[codeParam] = code }
 
   if (!params.client_id) { params.client_id = provider.clientId }

src/server/lib/oauth/client.js

@@ -3,9 +3,9 @@
 // would be easier to maintain if all the code was native to next-auth.
 import { OAuth, OAuth2 } from 'oauth'
 
-export default (provider) => {
-  if (provider.version && provider.version.startsWith('2.')) {
-    // Handle oAuth v2.x
+export default function oAuthClient (provider) {
+  if (provider.version?.startsWith('2.')) {
+    // Handle OAuth v2.x
     const basePath = new URL(provider.authorizationUrl).origin
     const authorizePath = new URL(provider.authorizationUrl).pathname
     const accessTokenPath = new URL(provider.accessTokenUrl).pathname
@@ -17,7 +17,7 @@ export default (provider) => {
       accessTokenPath,
       provider.headers)
   } else {
-    // Handle oAuth v1.x
+    // Handle OAuth v1.x
     return new OAuth(
       provider.requestTokenUrl,
       provider.accessTokenUrl,

src/server/lib/signin/oauth.js

@@ -2,19 +2,19 @@ import oAuthClient from '../oauth/client'
 import { createHash } from 'crypto'
 import logger from '../../../lib/logger'
 
-export default (provider, csrfToken, callback, authParams) => {
+export default function oAuthSignin ({ provider, csrfToken, callback, authParams, codeChallenge }) {
   const { callbackUrl } = provider
   const client = oAuthClient(provider)
-  if (provider.version && provider.version.startsWith('2.')) {
-    // Handle oAuth v2.x
-    let url = client.getAuthorizeUrl({
+  if (provider.version?.startsWith('2.')) {
+    // Handle OAuth v2.x
+    let url = new URL(client.getAuthorizeUrl({
       ...authParams,
       redirect_uri: provider.callbackUrl,
       scope: provider.scope,
       // A hash of the NextAuth.js CSRF token is used as the state
       state: createHash('sha256').update(csrfToken).digest('hex'),
       ...provider.additionalAuthorizeParams
-    })
+    }))
 
     // If the authorizationUrl specified in the config has query parameters on it
     // make sure they are included in the URL we return.
@@ -24,14 +24,19 @@ export default (provider, csrfToken, callback, authParams) => {
     //
     // https://github.com/ciaranj/node-oauth/pull/193
     if (provider.authorizationUrl.includes('?')) {
-      const parseUrl = new URL(provider.authorizationUrl)
-      const baseUrl = `${parseUrl.origin}${parseUrl.pathname}?`
-      url = url.replace(baseUrl, provider.authorizationUrl + '&')
+      const providerParams = new URLSearchParams(provider.authorizationUrl.split('?')[1])
+      const newParams = { ...url.searchParams, ...providerParams }
+      url = new URL(newParams.toString(), url)
+    }
+
+    if (provider.pkce) {
+      url.searchParams.append('code_challenge', codeChallenge)
+      url.searchParams.append('code_challenge_method', 'S256')
     }
 
     callback(null, url)
   } else {
-    // Handle oAuth v1.x
+    // Handle OAuth v1.x
     client.getOAuthRequestToken((error, oAuthToken) => {
       if (error) {
         logger.error('GET_AUTHORISATION_URL_ERROR', error)

src/server/routes/callback.js

@@ -5,7 +5,7 @@ import cookie from '../lib/cookie'
 import logger from '../../lib/logger'
 import dispatchEvent from '../lib/dispatch-event'
 
-export default async (req, res, options, done) => {
+export default async function callback (req, res, options, done, codeVerifier) {
   const {
     provider: providerName,
     providers,
@@ -127,7 +127,7 @@ export default async (req, res, options, done) => {
             return redirect(`${baseUrl}${basePath}/error?error=Callback`)
           }
         }
-      })
+      }, codeVerifier)
     } catch (error) {
       logger.error('OAUTH_CALLBACK_ERROR', error)
       return redirect(`${baseUrl}${basePath}/error?error=Callback`)

src/server/routes/signin.js

@@ -3,7 +3,7 @@ import oAuthSignin from '../lib/signin/oauth'
 import emailSignin from '../lib/signin/email'
 import logger from '../../lib/logger'
 
-export default async (req, res, options, done) => {
+export default async function signin ({ req, res, options, done, codeChallenge }) {
   const {
     provider: providerName,
     providers,
@@ -26,14 +26,19 @@ export default async (req, res, options, done) => {
     const authParams = { ...req.query }
     delete authParams.nextauth // This is probably not intended to be sent to the provider, remove
 
-    oAuthSignin(provider, csrfToken, (error, oAuthSigninUrl) => {
-      if (error) {
-        logger.error('SIGNIN_OAUTH_ERROR', error)
-        return redirect(`${baseUrl}${basePath}/error?error=OAuthSignin`)
-      }
-
-      return redirect(oAuthSigninUrl)
-    }, authParams)
+    oAuthSignin({
+      provider,
+      csrfToken,
+      callback (error, oAuthSigninUrl) {
+        if (error) {
+          logger.error('SIGNIN_OAUTH_ERROR', error)
+          return redirect(`${baseUrl}${basePath}/error?error=OAuthSignin`)
+        }
+        return redirect(oAuthSigninUrl)
+      },
+      authParams,
+      codeChallenge
+    })
   } else if (type === 'email' && req.method === 'POST') {
     if (!adapter) {
       logger.error('EMAIL_REQUIRES_ADAPTER_ERROR')