Chunking session cookies throws errors on decode and logs user out #293
Comments
|
+1 having same issue. |
|
Hey @janhoogeveen 👋 Thanks for the report - noted, it'll take us some time to look into this, other issues have higher priorities right now. If you want to provide a fix though, or I can help you to walk through it that would be very welcome (: |
|
@BracketJohn I'd keen to help get this resolved - I've enabled debugging messages but I'm not seeing anything that would indicate what's causing the issue when trying recombine the chunks. For me, it comes from trying to pass the access token and refresh token back from the IDP to the user and persist it in the token. I'm thinking there's two alternative solutions.
I know general support for static apps isn't a there, so any guidance on where to dig into the chunk issue, or any insights into if option 2 could be done would be appreciated. |
|
@BracketJohn I understand. I'll see how far I can get on my own, or with the help of @kilakewe. The first login works well. That we know. Based on this, I had a theory that the order of the cookies, or the chunks, was not guaranteed. I've been logging the chunks that are used in next-auth/core/lib/cookies.js Logs from first login (valid, working tokens)Which leads us to the result from values.join() So far, so good! Refreshing the pageNext, I kept refreshing the page until I triggered an error. Compare with the previous logs. And that returns the following token after doing the values.join() method. Which will finally give us the NextNow, there's multiple possibilities here to explore.
Let me know what you think. I can always start a discussion or issue in next-auth as well. |
|
Thanks for taking time to look into this - I really appreaciate it! As it's realted to really low-level cookie ordering, this is likely either (1) or (2), as Having a nextauthjs/next-auth#5398 is probably already a good lead, great find! Btw: You could re-try with the latest supported next-auth version just for fun to see if maybe they've (accidentally) solved the problem. |
|
So I did a bit more digging and I don't think it's the chunk ordering that is the issue because when I replace the encrpyt and decrypt to produce something other than the JWE, it works. 😖 For example, If I produce a JWT instead with the following functions, it has not issues: jwt: {
async encode(params) {
if (!params.token) throw new Error("Missing Token");
if (!params.secret) throw new Error("Missing Secret");
// Create a JWS JWT
const jwt = await encodeJwt(params.token || {}, params.secret as string);
return jwt;
},
async decode(params) {
if (!params.token) throw new Error("Missing Token");
if (!params.secret) throw new Error("Missing Secret");
// Decode and verify a JWS JWT
const token = await decodeJwt(
params.token || "",
params.secret as string
);
return token;
},
},There's something with how the default JWE functions work that's causing the kerfuffle. |
|
Related to this: #371 @kilakewe thanks for digging deeper, can the comment of @kenkichi in #371 maybe help? Quote:
|
|
Thanks @BracketJohn So I was able to sort the cookies but it looks like the issue is firing before the the cookie process finishes which leads me to believe that there's a promise not being handled correctly somewhere. The result of injecting logging in the process: |
|
Alright, it's been awhile since i've been able to dig into it and I've discovered that it indeed has something to do with the chunker or the chunking process. I was able to inspect the token JWE at the point of encryption and decryption and what I found was that when the token we recompiled from the chunks, it was indeed out of order. @BracketJohn, Is the chunking system something that's coming from NextAuth? |
|
Also ran into this issue today. Thanks for looking into it. |
|
PR to resolve this has been submitted - Please give it a thumbs up to get it moved along. @BracketJohn I guess it'll need to be pulled in once it's merged. |
@kilakewe Thanks for working on this! Do you know when these changes will be available in the package or if I can use it before the next release? |
|
@christine927t not sure sorry, I'm not a part of the next-auth team, just a contributor out in the wild. |
|
The PR looks to be merged and released as a pre-release version. https://github.com/nextauthjs/next-auth/releases/tag/%40auth%2Fcore%400.8.2 |
|
@janhoogeveen I installed the pre-release @auth/[email protected] but I'm still seeing this issue with the cookies being split, then cleared after about 10 seconds and then my user is logged out and unauthenticated. Is there anything else I should have to do besides install the pre-release? |
That's the same thing that was happening to me too. It looks like there's more than just the chunking issue at play and not enough of a problem for any of the package owners help deep dive into it. Which is quite frustrating. Hopefully it's something that's addressed in the new version of of authjs and sidebase can upgrade/migrate to it, but for now I have up ditching sidebase/auth for a custom implementation. |
|
@kilakewe Ok thanks for confirming, just wanted to make sure I wasn't missing anything. I agree it's frustrating. I'm having to reduce the amount of user data I'm sending back with the initial login/authentication and then retrieve it again after login and update the user. I may end up having to switch to another package as well. |
|
Can confirm, using 0.6.0-beta.3 however, my tokens are less than 4kb and they still get chunked for some reason. That may be my user error though but the OPs error of re-joining chunked cookies does exist. |
|
The latest versions of |
Next auth or it's replacement, AuthJS? |
|
Next auth has it in. I've done a simple upgrade of the package and tested it and it seems to work as expected. I've rolled it up and published it to NPM under @codetheorist/nuxt-auth so I could test it properly, so you could test that package if you like. I've currently got a JWT with a lot of roles in it so it splits over 2 chunks and would normally log out and clear cookies, but everything works perfectly with regards to the cookie chunking issue now. I would expect the replacement to have it in too. |
|
OK, so I was convinced that My tests this morning must have just gotten the cookie chunks in order every time correctly which led me to believe that the issue was fixed. The module is now not working as expected on my end again. I've checked-out |
|
I'd like to know too, this issue needs to be fixed. |
|
Can confirm this is still a thing and the fix that was merged into I'm not entirely sure how the release process works internally with It would be best to pursue any further updates through the There is ongoing development on auth.js, so I'm not entirely sure if the functionality will ever be merged. TLDR; This is a supply chain issue and we are waiting for the "parent" package to release the fixes before we can update the dependency version number in this package. |
|
Created a PR fixing this here nextauthjs/next-auth#8278 A workaround is to rename the cookie to something without a |
|
Looks like it was fixed on https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.23.0 |
|
Any update/workaround for the issue? |
|
Any update/workaround for the issue? [2] |
|
@febinfrancis31 @diegogava you can try making you JWT and session smaller by only returning the essentials on the callback functions. This is what I did to keep my cookie under the size limit callbacks: {
/**
* NOTE: On this callback I'm only returning the essential data for the app to function.
* If I try to return the whole token instead, the cookie size gets too large and the
* plugin is unable to decode it properly.
*
*
*/
jwt ({ token, account }) {
if (account) {
token.accessToken = account.access_token
}
return {
accessToken: token.accessToken,
email: token.email,
name: token.name
}
},
session ({ session, token }) {
session.accessToken = token.accessToken
return session
}
} |
|
bump because I just wasted 3 hours struggling before finding out it was a bug :)
this works great for now, thank you. |
|
What if making the return value of the jwt callback not possible? All of this is of cause not needed in the session itself and the information are filtered properly (in the session callback), but as the return value of the jwt callback is encrypted and the token is used to populate the session, i cannot reduce these information. |
I have the exact same use case as I'm trying to implement a token refresh logic for my Cognito user pools. I need to be able to store the access and refresh tokens in the Any ideas? |
|
Also worth mentioning:
|
|
Any plans on this getting some kind of hotfix soon or do we simply have to wait for nuxt-auth to migrate to authjs v5 (seems to be the version where the patch is merged)? |
|
Hi everyone! After doing some more research, it seems like we will not be able to fix this issue on our end. As mentioned above the solution will be to migrate to authjs under the hood, where this issue has been resolved. We are now beginning this migration, for more information please keep an eye on #673. As this issue will be fixed through this migration, I will now close this issue. Thank you for all the hard work investigating! |
zoey-kaiser
added
provider-authjs
|
Any update/workaround for the issue? I'm using "@sidebase/nuxt-auth": "0.7.1", |
|
Closed via #726 |
|
How does the above commit fix the issue presented here? Genuine question. |
Environment
Darwinv18.14.23.3.12.3.1[email protected]viteextends,srcDir,runtimeConfig,app,imports,typescript,css,modules,tailwindcss@nuxtjs/[email protected]-Reproduction
Try to return this user including tokens from the authenticate method in the credentialsprovider:
You can find an edited version of the auth handler in my example repo, though @sidebase/nuxt-auth does not seem to run on codesandbox.
Describe the bug
When generating a JWT that is bigger than 4096 bytes, the next-auth core module will chunk your cookies. That way, you'll end up with 2 session tokens.
next-auth.session-token.0next-auth.session-token.1Initial login seems to work fine, and I can see I'm logged in.
However, when I reload the page I get an error in my console and my session cookies get removed automatically. Sometimes I need to reload a couple of times to trigger this. Sometimes it's immediate.
Additional context
Logs
When logging in or reloading the page:
[next-auth][debug][CHUNKING_SESSION_COOKIE] { 11:28:41 message: 'Session cookie exceeds allowed 4096 bytes.', emptyCookieSize: 163, valueSize: 4729, chunks: [ 4096, 959 ] }When hammering a page reload and it logs me out:
The text was updated successfully, but these errors were encountered: