authorization_code grant flow with cognito

[kekhuai]

i am implementing authorization_code grant type flow with Amazon Cognito.
right now i can manage to receive the authorization_code via query param after successfully signed in.
how can i invoke the token endpoint that specified in nuxt.config.js to exchange for the access_token ?

auth: {
    strategies: {
      amazonCognito: {
        scheme: 'oauth2',
        endpoints: {
          authorization: 'https://***.amazoncognito.com/oauth2/authorize',
          token: 'https://***.amazoncognito.com/oauth2/token',
          userInfo: 'https://***.amazoncognito.com/oauth2/userInfo',
          logout: 'https://example.com/logout'
        },
        token: {
          property: 'access_token',
          type: 'Bearer'
        },
        refreshToken: {
          property: 'refresh_token'
        },
        grantType: 'authorization_code',
        redirectUri: 'http://localhost:3000/callback',
        logoutRedirectUri: undefined,
        clientId: '***',
        scope: ['openid', 'profile', 'email'],
        codeChallengeMethod: '',
        responseMode: '',
        acrValues: ''
      }
    },
    redirect: {
      login: '/sign-in',
      logout: '/',
      home: '/'
    }
  }

[laisnegautier]

Same issue here: I can retrieve the authorization code then I have to fetch the user manually

[joergbs]

With AWS Cognito I tested the following scenarios:

Implicit grant

Result: Works
Comment: but in this case refresh tokens are not supported by AWS Cognito.
Configuration:

  auth: {
    strategies: {
      awscognito: {
        scheme: 'oauth2',
        endpoints: {
          authorization: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/oauth2/authorize',
          token: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/oauth2/token',
          userInfo: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/oauth2/userInfo',
          logout: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/logout'
        },
        token: {
          property: 'access_token',
          type: 'Bearer',
          maxAge: 1800
        },
        refreshToken: {
          property: 'refresh_token',
          maxAge: 60 * 60 * 24 * 30
        },
        responseType: 'token',
        accessType: undefined,
        redirectUri: 'http://localhost:3000/login',
        logoutRedirectUri: 'http://localhost:3000/login',
        clientId: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
        scope: ['openid', 'profile', 'email'],
        state: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
        codeChallengeMethod: 'S256',
        responseMode: '',
        acrValues: '',
        // autoLogout: false
      }
    }
  }

Authorization code grant (with empty codeChallengeMethod):

Result: Does not work.
Comments: AWS Cognito does not like when 'code_challenge_method' is empty. But when I re-execute the same get request with cURL without code_challenge_method, then it is successful.
Configuration:

  auth: {
    strategies: {
      awscognito: {
        scheme: 'oauth2',
        endpoints: {
          authorization: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/oauth2/authorize',
          token: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/oauth2/token',
          userInfo: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/oauth2/userInfo',
          logout: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/logout'
        },
        token: {
          property: 'access_token',
          type: 'Bearer',
          maxAge: 1800
        },
        refreshToken: {
          property: 'refresh_token',
          maxAge: 60 * 60 * 24 * 30
        },
        responseType: 'code',
        grantType: 'authorization_code',
        accessType: undefined,
        redirectUri: 'http://localhost:3000/login',
        logoutRedirectUri: 'http://localhost:3000/login',
        clientId: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
        scope: ['openid', 'profile', 'email'],
        state: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
        codeChallengeMethod: '',
        responseMode: '',
        acrValues: '',
        // autoLogout: false
      }
    }
  }

Authorization code grant (with codeChallengeMethod = S256):

Result: Does not work.
Comments: The request to the authorization endpoint works, but the request to the token endpoint fails with HTTP 400 (invalid client).
Configuration:

  auth: {
    strategies: {
      awscognito: {
        scheme: 'oauth2',
        endpoints: {
          authorization: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/oauth2/authorize',
          token: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/oauth2/token',
          userInfo: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/oauth2/userInfo',
          logout: 'https://xxxxxxxxxx.auth.us-east-1.amazoncognito.com/logout'
        },
        token: {
          property: 'access_token',
          type: 'Bearer',
          maxAge: 1800
        },
        refreshToken: {
          property: 'refresh_token',
          maxAge: 60 * 60 * 24 * 30
        },
        responseType: 'code',
        grantType: 'authorization_code',
        accessType: undefined,
        redirectUri: 'http://localhost:3000/login',
        logoutRedirectUri: 'http://localhost:3000/login',
        clientId: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
        scope: ['openid', 'profile', 'email'],
        state: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
        codeChallengeMethod: 'S256',
        responseMode: '',
        acrValues: '',
        // autoLogout: false
      }
    }
  }

based on that I believe there are two issues:

1. there need to be an extra option to control whether or not to send the code_challenge_method parameter. Or, alternativly, simply do not send the code_challenge_method parameter, when option codeChallengeMethod is an empty string.
2. if the codeChallengeMethod option is set to S256, then either auth or cognito verify differently (not sure which one is wrong).

Issue related to #850

[bmulholland]

What we should probably do is have codeChallengeMethod: null prevent the parameter from being sent. Contributes adding that would be welcomed.