NextAuth.js + Auth0：offline_access 打破 jwt 解密答案

【问题标题】：NextAuth.js + Auth0: offline_access breaks jwt decryptionNextAuth.js + Auth0：offline_access 打破 jwt 解密
【发布时间】：2022-01-24 04:51:18
【问题描述】：

我正在尝试使用 Auth0 提供程序将 next-auth 实施到现有应用程序。一切正常，但是当我尝试添加 offline_access 范围以检索刷新令牌时，应用程序会在几秒钟后随机崩溃：

https://next-auth.js.org/warnings#no_secret
[next-auth][error][JWT_SESSION_ERROR]
https://next-auth.js.org/errors#jwt_session_error decryption operation failed {
  message: 'decryption operation failed',
  stack: 'JWEDecryptionFailed: decryption operation failed\n' +
    '    at gcmDecrypt (my_path/node_modules/jose/dist/node/cjs/runtime/decrypt.js:67:15)\n' +
    '    at decrypt (my_path/node_modules/jose/dist/node/cjs/runtime/decrypt.js:92:20)\n' +
    '    at flattenedDecrypt (my_path/node_modules/jose/dist/node/cjs/jwe/flattened/decrypt.js:119:52)\n' +
    '    at runMicrotasks (<anonymous>)\n' +
    '    at processTicksAndRejections (internal/process/task_queues.js:95:5)\n' +
    '    at async compactDecrypt (my_path/node_modules/jose/dist/node/cjs/jwe/compact/decrypt.js:18:23)\n' +
    '    at async jwtDecrypt (my_path/node_modules/jose/dist/node/cjs/jwt/decrypt.js:8:23)\n' +
    '    at async Object.decode (my_path/node_modules/next-auth/jwt/index.js:62:7)\n' +
    '    at async Object.session (my_path/node_modules/next-auth/core/routes/session.js:41:28)\n' +
    '    at async NextAuthHandler (my_path/node_modules/next-auth/core/index.js:96:27)\n' +
    '    at async NextAuthNextHandler (my_path/node_modules/next-auth/next/index.js:20:19)\n' +
    '    at async my_path/node_modules/next-auth/next/index.js:56:32\n' +
    '    at async apiResolver (my_path/node_modules/next/dist/next-server/server/api-utils.js:8:1)\n' +
    '    at async DevServer.handleApiRequest (my_path/node_modules/next/dist/next-server/server/next-server.js:64:462)\n' +
    '    at async Object.fn (my_path/node_modules/next/dist/next-server/server/next-server.js:56:492)\n' +
    '    at async Router.execute (my_path/node_modules/next/dist/next-server/server/router.js:23:67)',
  name: 'JWEDecryptionFailed'
}

目前我什至没有尝试对刷新令牌做任何事情，只是更改了范围。当恢复到默认范围时，一切都会再次正常。

这是我的代码：

export default NextAuth({
    // Configure one or more authentication providers
    providers: [
      Auth0Provider({
        clientId: CLIENT_ID,
        clientSecret: CLIENT_SECRET,
        issuer: ISSUER,
        idToken: true,
        // authorization: {params: {scope: 'openid email profile offline_access'}},
      }),
    ],
    callbacks: {
      async signIn({profile}) {
        // Sentry.setUser(...)
        return true
      },
      async redirect({baseUrl}) {
        return baseUrl
      },
      async jwt({token, account, profile}) {
        if (account) {
          token.accessToken = account.id_token
        }
        if (profile) {
          token.profile = profile['https://my-company-oauth-profile-path/']
        }
  
        return token
      },
      async session({session, token}) {
        session.accessToken = token.accessToken
        session.profile = token.profile
        return session
      },
    },
    pages: {
      signIn: '/auth/signin',
    },
    debug: true,
})

我的下一个授权版本是“4.1.2”。

【问题讨论】：

标签： javascript next.js auth0 next-auth

【解决方案1】：

对于任何为类似事情苦苦挣扎的人：

https://next-auth.js.org/configuration/options#secret

默认行为是 volatile，强烈建议您明确指定一个值 [for the secret option]。如果在生产中省略了secret，则会引发错误。

【讨论】：