feat: add experimental signInWithIdToken for Apple, Google

[hf]

Adds signInWithIdToken as experimental. This brings back the ID token login flow for Sign in with Apple and Sign in with Google for iOS and Android apps.

It's marked as experimental since there are some known issues with this endpoint, but we do realize the importance of having this method available as Sign in with Apple is mandatory on iOS devices.

[DanMossa]

When using this endpoint, I'm getting a 502Bad Gateway response. Has this been verified to worK?

[jaytxng]

Been working on integrating Apple and seeing this 502 gateway error as well.

I've reached out to support@supabase.com yesterday regarding this issue, so hopefully someone can look into what's causing this.

edit: no longer seeing the 502 gateway error anymore!

[DanMossa]

@jaytxng I'm emailing someone from support back and forth about this. The way I was originally Signing in with Apple and Google failed due to server changes. I'm trying this out and yeah I'm getting the 502

[DanMossa]

Also: please don't merge this in without making sure it works
supabase/auth#927

[kangmingtay]

Hi @DanMossa we haven't merged this in yet because the gotrue version on the Supabase platform is still on v2.40.1, which doesn't contain the changes in supabase/gotrue#927.

[jaytxng]

@DanMossa heads up, I'm no longer seeing that 502 error anymore 😄

[DanMossa]

@DanMossa heads up, I'm no longer seeing that 502 error anymore 😄

Yup! After talking to support they disabled the endpoint. They just had to re enable it!

[github-actions]

🎉 This PR is included in version 2.12.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀

[johnryan]

Hi All - thanks for bringing this back. I've been trying to get it working with google auth and getting an error Passed nonce and nonce in id_token should either both exist or not. Is this expected to work with google?

[DanMossa]

Hi All - thanks for bringing this back. I've been trying to get it working with google auth and getting an error Passed nonce and nonce in id_token should either both exist or not. Is this expected to work with google?

Yup! I'm using it now. Are you passing a nonce when using Sign in with Google?

Does the JWT token you get from Google contain a nonce?

[johnryan]

Thanks for the reply! I didn't actually realize the id token was a JWT but it looks like it does actually contain one - does that mean on the client I should decode the JWT then pass that nonce into the argument? I had (obviously incorrectly) assumed that the nonce would be in payload response.

…

On Sat, Feb 25, 2023 at 9:51 PM Daniel Mossaband ***@***.***> wrote: Hi All - thanks for bringing this back. I've been trying to get it working with google auth and getting an error Passed nonce and nonce in id_token should either both exist or not. Is this expected to work with google? Yup! I'm using it now. Are you passing a nonce when using Sign in with Google? Does the JWT token you get from Google contain a nonce? — Reply to this email directly, view it on GitHub <#603 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADFWNFPWLQLHVAYXUMOYRDWZLAL5ANCNFSM6AAAAAAUPHQPM4> . You are receiving this because you commented.Message ID: ***@***.***>

[johnryan]

Update: I tried pulling the nonce out of the JWT manually and passing it in the nonce arg but now getting an "Invalid nonce" error 🤦‍♂️

…

On Sat, Feb 25, 2023 at 9:57 PM John Ryan ***@***.***> wrote: Thanks for the reply! I didn't actually realize the id token was a JWT but it looks like it does actually contain one - does that mean on the client I should decode the JWT then pass that nonce into the argument? I had (obviously incorrectly) assumed that the nonce would be in payload response. On Sat, Feb 25, 2023 at 9:51 PM Daniel Mossaband ***@***.***> wrote: > Hi All - thanks for bringing this back. I've been trying to get it > working with google auth and getting an error Passed nonce and nonce in > id_token should either both exist or not. Is this expected to work with > google? > > Yup! I'm using it now. Are you passing a nonce when using Sign in with > Google? > > Does the JWT token you get from Google contain a nonce? > > — > Reply to this email directly, view it on GitHub > <#603 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AADFWNFPWLQLHVAYXUMOYRDWZLAL5ANCNFSM6AAAAAAUPHQPM4> > . > You are receiving this because you commented.Message ID: > ***@***.***> >

[laotala828]

I am having the same issue: Passed nonce and nonce in id_token should either both exist or not. I am using this one https://github.com/CodetrixStudio/CapacitorGoogleAuth and get something like this:

 authentication: {
			refreshToken: '1//06VJKB6bMT0oXCgYIQWERGAYSNwF-L9IrRWKTodx0Ir_PQvMUhB3YMFYVzXfY2utSgB2JkkqGxrUB ...',
			idToken: 'eyJhbGciQWE345GBH75IsImtpGHI6IjYwOASkZDU5ODE2NzNmNjYxZmRlOWRhZTY0NmI2ZjAzONGhMDE0NWMiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLERhenAiOiI3NDUxODY3NTM2MTMtaGI1N3MwZDNhaXZsYmVmdTNtcmVpbGU4c3N1cjd...',
			accessToken: 'ya29.a0AWY7CknAaGYidqUpcPn21IPgDiQTXhvaeSY7-o-dmMCKqDS2SzJYuJqqROS9zoWPTYUrAAlU-EIrLVKecCwzr3AnoBCZtIq7RlnCRyYPqpE4...'
		}

When I pass the Idtoken to signInWithIdToken I get error: Passed nonce and nonce in id_token should either both exist or not.

If I decode the idToken I can get the nonce, but when I pass it in I got error: invalid nonce

[matteo6b]

Hi the same error Passed nonce and nonce in id_token should either both exist or not.

@laotala828 how you decode nonce in id token ?

[laotala828]

@matteo6b

Hi the same error Passed nonce and nonce in id_token should either both exist or not.

@laotala828 how you decode nonce in id token ?

You can paste your idtoken in the JWT site https://jwt.io/ and it can show you a decoded object.
In my code I use this one: https://www.npmjs.com/package/jwt-decode

[robertn702]

Has anyone been able to get around the Passed nonce and nonce in id_token should either both exist or not issue?

Currently using react-native-google-signin/google-signin to retrieve the id token and passing it to supabase.auth.signInWithIdToken returns this error.

Edit:
Parsing the nonce from the id token and including it with signInWithIdToken produces the error Nonces mismatch.

[laotala828]

Has anyone been able to get around the Passed nonce and nonce in id_token should either both exist or not issue?

Currently using react-native-google-signin/google-signin to retrieve the id token and passing it to supabase.auth.signInWithIdToken returns this error.

Edit: Parsing the nonce from the id token and including it with signInWithIdToken produces the error Nonces mismatch.

Hey @robertn702 I did not solve this problem, but I do have a solution to allow user to Oauth log in on iOS. Previously I used React Native and now I am using Capacitorjs, it works for both. For RN you use the Linking feature, and for Capacitor you use the appUrlOpen event on App. Basically you ask users to open the gotrue endpoint url in browser, for example:

${SUPABASE_URL}/auth/v1/authorizeprovider=google&redirect_to=${SIGN_IN_CALL_BACK}&access_type=offline&prompt=consent

You can set SIGN_IN_CALL_BACK as the URL scheme of you app, for example com.my.app://logincallback and set the URL scheme for your ios app. Easy tutorial here.

Then after users signing in or up using google oauth, they will be redirected to your app, and you will get a string url like this com.my.app://logincallback#access_token=....&refresh_token=.... Replace # with a ? and turn the string url into an real URL object, you can easily get the access_token and refresh_token.

const url_string = url.replace('${SIGN_IN_CALL_BACK}#', '${SIGN_IN_CALL_BACK}?'); const new_url = new URL(url_string); const refresh_token = new_url.searchParams.get('refresh_token'); const access_token = new_url.searchParams.get('access_token');

Finally you call the seSession function and you will get the info you need and log users in.
const session_result = await supabase.auth.setSession({ access_token, refresh_token });

[will-break-it]

@laotala828 how were you able to set the redirect url correctly? In supabase I have a web redirect url and in google cloud I can't add an app specific url scheme since google enforces to create a dedicated iOS client secret.

[laotala828]

@laotala828 how were you able to set the redirect url correctly? In supabase I have a web redirect url and in google cloud I can't add an app specific url scheme since google enforces to create a dedicated iOS client secret.

The method I mentioned is using the web client secret in GCP, you don't need an iOS client secret.