I am currently integrating next-auth with the Auth0 provider into an existing application. Everything is functioning properly, however, when attempting to include the offline_access scope in order to retrieve a refresh token, the application randomly crashes after a few seconds:
https://next-auth.js.org/warnings#no_secret
[next-auth][error][JWT_SESSION_ERROR]
https://next-auth.js.org/errors#jwt_session_error decryption operation failed {
message: 'decryption operation failed',
stack: 'JWEDecryptionFailed: decryption operation failed\n' +
' at gcmDecrypt (my_path/node_modules/jose/dist/node/cjs/runtime/decrypt.js:67:15)\n' +
' at decrypt (my_path/node_modules/jose/dist/node/cjs/runtime/decrypt.js:92:20)\n' +
' at flattenedDecrypt (my_path/node_modules/jose/dist/node/cjs/jwe/flattened/decrypt.js:119:52)\n' +
' at runMicrotasks (<anonymous>)\n' +
' at processTicksAndRejections (internal/process/task_queues.js:95:5)\n' +
' at async compactDecrypt (my_path/node_modules/jose/dist/node/cjs/jwe/compact/decrypt.js:18:23)\n' +
' at async jwtDecrypt (my_path/node_modules/jose/dist/node/cjs/jwt/decrypt.js:8:23)\n' +
' at async Object.decode (my_path/node_modules/next-auth/jwt/index.js:62:7)\n' +
' at async Object.session (my_path/node_modules/next-auth/core/routes/session.js:41:28)\n' +
' at async NextAuthHandler (my_path/node_modules/next-auth/core/index.js:96:27)\n' +
' at async NextAuthNextHandler (my_path/node_modules/next-auth/next/index.js:20:19)\n' +
' at async my_path/node_modules/next-auth/next/index.js:56:32\n' +
' at async apiResolver (my_path/node_modules/next/dist/next-server/server/api-utils.js:8:1)\n' +
' at async DevServer.handleApiRequest (my_path/node_modules/next/dist/next-server/server/next-server.js:64:462)\n' +
' at async Object.fn (my_path/node_modules/next/dist/next-server/server/next-server.js:56:492)\n' +
' at async Router.execute (my_path/node_modules/next/dist/next-server/server/router.js:23:67)',
name: 'JWEDecryptionFailed'
}
At the moment, I am simply adjusting the scopes and not actively using the refresh token. Returning to the default scopes resolves the issue.
Below is the code snippet:
export default NextAuth({
// Configure one or more authentication providers
providers: [
Auth0Provider({
clientId: CLIENT_ID,
clientSecret: CLIENT_SECRET,
issuer: ISSUER,
idToken: true,
// authorization: {params: {scope: 'openid email profile offline_access'}},
}),
],
callbacks: {
async signIn({profile}) {
// Sentry.setUser(...)
return true
},
async redirect({baseUrl}) {
return baseUrl
},
async jwt({token, account, profile}) {
if (account) {
token.accessToken = account.id_token
}
if (profile) {
token.profile = profile['https://my-company-oauth-profile-path/']
}
return token
},
async session({session, token}) {
session.accessToken = token.accessToken
session.profile = token.profile
return session
},
},
pages: {
signIn: '/auth/signin',
},
debug: true,
})
The next-auth version I am using is "4.1.2".