[Apple] PKCE code_verifier cookie was missing

[marlon360]

I got this error PKCE code_verifier cookie was missing when using the Apple provider.
It happens in the callback endpoint.

Does anybody know how to setup the Apple provider correctly?

next: 13.2.1
next-auth: 4.20.1

[desenmeng]

add cookies config

  cookies: {
    pkceCodeVerifier: {
      name: "next-auth.pkce.code_verifier",
      options: {
        httpOnly: true,
        sameSite: "none",
        path: "/",
        secure: true,
      },
    },
  },

[jhirvioja]

Why does this work, and does it introduce any security flaws? I see it introduces sameSite: 'none' to the options, which I am hesitant to use..

[matt-wigg]

I get the same error with the AzureADProvider /discussions/10502

[KubaVejrazka]

pkceCodeVerifier: {
    name: 'next-auth.pkce.code_verifier',
    options: {
      httpOnly: true,
      sameSite: 'none',
      path: '/',
      secure: process.env.NODE_ENV === 'production',
    },
  },

@nkeil Hi, thanks for your reply, but still doesn't work. actually my next-auth behave weird not sure if it's my problem or what. I'm working on a personal project and facing 4 weird situations

1. no matter I input the wrong email or password for the credential login, next-auth response ok: true and status:200 , doesn't affect the feature just feel a bit confuse or I login successfully next-auth still response with the error:OAuthcallback
2. for the github login, I have to login and logout with credential first then I could create with github successfully otherwise will get an state cookie missing or state mismatch error
3. for the github login, even I create a user in my DB(I use mongoDB) successfully but I can't get the session using getServerSession which means I can't login with github account
4. google login, no luck to success, keep getting PKCE code_verifier cookie was missing error

do you mind if I share you the code , if you have time help me to take a look?

Hey, have you found a solution? I need to implement google oauth and I have the same problem. No matter how i set up my cookies, i still get the "InvalidCheck: PKCE code_verifier cookie was missing." error.

Thanks!

[KubaVejrazka]

Hey everyone,

I've found the cause of this problem (in my case) and somewhat of a solution.

I was hosting the website to a public ip by port forwarding my localhost, which caused mismatch and led to this error.

Once I set the redirect proxy to <public ip>/auth, I finally got rid of the error, however I still wasn't able to complete the callback because SvelteKit (which I'm building my web app with) kept adding the localhost port to my public URI. But the oAuth request went through without any problems.

The way I solved all of these issues was by hosting my app directly to a public IP. You can do this for free by using a service like Vercel. In my auth config I removed both the code verifier cookie config recommended by this issue's answer and the redirect proxy, and I set trustHost to true.

Conclusion:
If you are port forwarding localhost, try setting a redirect proxy in your auth config to <public ip>/<auth route>.
If you still face issues (for example the localhost port being added to your callback URI) that you don't know how to fix, try hosting your app directly to a public ip.

I hope I helped someone :)

[pranavmappoli]

cookies: {
  pkceCodeVerifier: {
    name: 'next-auth.pkce.code_verifier',
    options: {
      httpOnly: true,
      sameSite: 'none',
      path: '/',
      secure: process.env.NODE_ENV === 'production',
    },
  },
},

@trevorpfiz Did you find any solution ?