feat(adapter-nextjs): server-side auth flows integrating cognito hosted UI #13827

HuiSF · 2024-09-19T01:36:43Z

Description of changes

Implemented the following flow integrating Cognito Hosted UI endpoints:

sign-in -> Hosted UI -> sign-in-callback (including Social Providers) -> httpOnly cookies
sign-up -> Hosted UI -> sign-in-callback -> httpOnly cookies
sign-out -> Hosted UI -> sign-out-callback -> httpOnly cookies

API Route handlers work with both Next.js App Router and Pages Router.

Issue #, if available

Description of how you validated changes

Unit tests
Manual testing with Next.js samples apps created with the App Router and Pages Router

Checklist

PR description included
yarn test passes
Unit Tests are changed or added
Relevant documentation is changed or added (and PR referenced)

Checklist for repo maintainers

Verify E2E tests for existing workflows are working as expected or add E2E tests for newly added workflows
New source file paths included in this PR have been added to CODEOWNERS, if appropriate

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
…ide auth…ide auth…ide auth

HuiSF · 2024-09-19T01:38:33Z

packages/adapter-nextjs/tsconfig.json

-		"alwaysStrict": true
+		"alwaysStrict": true,
+		"lib": [
+			"esnext"


The base tsconfig has jsdom as a lib, that makes origin variable a legit global variable which is not desired.

HuiSF · 2024-09-19T01:39:46Z

packages/adapter-nextjs/src/utils/cookie/serializeCookie.ts

Existing impl. moved out.

HuiSF · 2024-09-19T01:39:56Z

packages/adapter-nextjs/src/utils/cookie/ensureEncodedForJSCookie.ts

Existing impl. moved out.

HuiSF · 2024-09-19T17:35:03Z

packages/adapter-nextjs/src/auth/utils/tokenCookies.ts

+	path: '/',
+	httpOnly: true,
+	secure: true,


These three attributes are not configurable.

jjarvisp

Almost done with review, I should be able to wrap up soon.

packages/adapter-nextjs/src/auth/utils/getSearchParamValueFromUrl.ts

packages/adapter-nextjs/src/auth/utils/getCookieValuesFromRequest.ts

packages/adapter-nextjs/src/auth/utils/resolveRedirectUrl.ts

packages/adapter-nextjs/src/auth/utils/resolveIdentityProviderFromUrl.ts

packages/adapter-nextjs/src/auth/utils/getCookieValuesFromNextApiRequest.ts

packages/adapter-nextjs/src/auth/handlers/handleSignOutCallbackRequestForPagesRouter.ts

jjarvisp · 2024-11-29T19:52:16Z

packages/adapter-nextjs/src/auth/utils/getAccessTokenUsernameAndClockDrift.ts

+	const decoded = decodeJWT(accessToken);
+	const issuedAt = (decoded.payload.iat ?? 0) * 1000;
+	const clockDrift = issuedAt > 0 ? issuedAt - Date.now() : 0;
+	const username = (decoded.payload.username as string) ?? 'username';


Are there valid scenarios when username would be missing from payload or any particular reasoning around default username to "username"?

Not really. I just followed the original client-side impl.
This is a good question, let me dig and get back to you.

packages/adapter-nextjs/src/auth/utils/createUrlSearchParams.ts

packages/adapter-nextjs/src/auth/handlers/handleSignOutRequestForPagesRouter.ts

packages/adapter-nextjs/src/auth/handlers/handleSignInSignUpRequestForPagesRouter.ts

packages/adapter-nextjs/__tests__/auth/utils/tokenCookies.test.ts

packages/adapter-nextjs/__tests__/auth/utils/getAccessTokenUsernameAndClockDrift.test.ts

packages/adapter-nextjs/src/auth/utils/createOnSignInCompletedRedirectIntermediate.ts

packages/adapter-nextjs/src/auth/handlers/handleSignInCallbackRequestForPagesRouter.ts

…ide auth

… auth

…hosted ui

packages/adapter-nextjs/src/auth/handlers/handleSignOutCallbackRequest.ts

AllanZhengYP · 2024-12-23T18:20:15Z

packages/adapter-nextjs/src/auth/handlers/handleSignInCallbackRequest.ts

+}) => {
+	const { code, state } = resolveCodeAndStateFromUrl(request.url);
+	if (!code || !state) {
+		return new Response(null, { status: 400 });


Do we see needs for customers to customize the error payloads and render different messages accordingly?

AllanZhengYP · 2024-12-23T18:33:00Z

packages/adapter-nextjs/src/auth/handlers/handleSignInCallbackRequest.ts

+	);
+	appendSetCookieHeaders(
+		headers,
+		createSignInFlowProofCookies({ state: '', pkce: '' }),


Super nit: prefer to re-name this locally to callout the cookie removal, similar to the next line. Something like

createSignInFlowProofRemoveCookies(),

Which is also a similar practice to the createTokenRemoveCookies below

This function sets only cookie name-value - which is not add or remove specific. The only difference is on the options.

AllanZhengYP · 2024-12-23T18:44:40Z

packages/adapter-nextjs/src/auth/handlers/handleSignOutCallbackRequestForPagesRouter.ts

+		oAuthConfig,
+		setCookieOptions,
+	}) => {
+		const { [IS_SIGNING_OUT_COOKIE_NAME]: isSigningOut } =


Clarification question, how is this isSigningOut cookie used?

When isSigningOut is true proceed with handleSignOutCallback otherwise client is doing something wrong.

AllanZhengYP · 2024-12-23T18:54:15Z

packages/adapter-nextjs/src/auth/handlers/handleSignInSignUpRequest.ts

+	setCookieOptions,
+	type,
+}) => {
+	const { codeVerifier, state } = createAuthFlowProofs({ customState });


Clarify question: do we need to return early if CX is already signed in?

Yes, that's what's the next PR adds: #13839

AllanZhengYP · 2024-12-23T18:55:48Z

packages/adapter-nextjs/src/auth/utils/authFlowProofCookies.ts

+	httpOnly: true,
+	secure: true,
+	sameSite: 'lax' as const,
+	expires: new Date(Date.now() + AUTH_FLOW_PROOF_COOKIE_EXPIRY),


Do we need to count for clock drift here? Maybe it's handled in the orchestrator, but just want to double check.

Good question - should use maxAge attribute here to avoid concerns of clock drift. Will update.

I will do this in a separate PR.

AllanZhengYP · 2024-12-23T20:01:16Z

packages/adapter-nextjs/src/auth/utils/resolveRedirectUrl.ts

+	oAuthConfig: OAuthConfig,
+) => {
+	const redirectUrl = oAuthConfig.redirectSignIn.find(url =>
+		url.startsWith(origin),


Should we use the URL util and parse the origin from the oAuthConfig more strictly?

I don't think it's necessary to construct a URL object from the config redirect URL strings - as a client-side validation this should be good enough, as eventually HostedUI will also match the URL on the service side.

HuiSF requested review from ukhan-amazon, haverchuck, cshfang, jimblanc and a team as code owners September 19, 2024 01:36

HuiSF commented Sep 19, 2024

View reviewed changes

packages/adapter-nextjs/src/utils/cookie/serializeCookie.ts Outdated

Copy link

Member Author

HuiSF Sep 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Existing impl. moved out.

HuiSF commented Sep 19, 2024

View reviewed changes

packages/adapter-nextjs/src/utils/cookie/ensureEncodedForJSCookie.ts Outdated

Copy link

Member Author

HuiSF Sep 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Existing impl. moved out.

ashika112 changed the title ~~eat(adapter-nextjs): server-side auth flows integrating cognio hosted UI~~ feat(adapter-nextjs): server-side auth flows integrating cognio hosted UI Sep 19, 2024

HuiSF force-pushed the hui/feat/adapter-nextjs/3-auth-api-handlers-impl branch from 6087817 to ae36b32 Compare September 19, 2024 17:23

HuiSF commented Sep 19, 2024

View reviewed changes

HuiSF force-pushed the hui/feat/adapter-nextjs/3-auth-api-handlers-impl branch from ae36b32 to 621d0cb Compare September 19, 2024 18:26

HuiSF force-pushed the hui/feat/adapter-nextjs/2-auth-api-handlers branch from 25c4eaa to 26ec9ed Compare October 1, 2024 23:02

HuiSF force-pushed the hui/feat/adapter-nextjs/3-auth-api-handlers-impl branch from 621d0cb to 284acbf Compare October 1, 2024 23:02

HuiSF force-pushed the hui/feat/adapter-nextjs/2-auth-api-handlers branch from 26ec9ed to 67d073f Compare November 21, 2024 17:05

HuiSF requested a review from pranavosu as a code owner November 21, 2024 17:05

HuiSF force-pushed the hui/feat/adapter-nextjs/3-auth-api-handlers-impl branch from 284acbf to 0ef2b81 Compare November 21, 2024 17:06

jjarvisp changed the title ~~feat(adapter-nextjs): server-side auth flows integrating cognio hosted UI~~ feat(adapter-nextjs): server-side auth flows integrating cognito hosted UI Nov 22, 2024

jjarvisp reviewed Dec 2, 2024

View reviewed changes

packages/adapter-nextjs/__tests__/auth/utils/tokenCookies.test.ts Outdated Show resolved Hide resolved

jjarvisp reviewed Dec 3, 2024

View reviewed changes

Base automatically changed from hui/feat/adapter-nextjs/2-auth-api-handlers to feat/server-auth/main December 20, 2024 18:56

HuiSF requested a review from sktimalsina as a code owner December 20, 2024 18:56

HuiSF added 3 commits December 20, 2024 16:21

chore(auth): export necessary utilities and types to support server-s…

acd2e41

…ide auth

chore(aws-amplify): export necessary utilities to support server-side…

fc1f867

… auth

feat(adapter-nextjs): server-side auth api route integrating cognito …

ff48e7a

…hosted ui

HuiSF force-pushed the hui/feat/adapter-nextjs/3-auth-api-handlers-impl branch from 0ef2b81 to ff48e7a Compare December 21, 2024 00:30

chore(adapter-nextjs): resolve comments

56dd741

jjarvisp approved these changes Dec 23, 2024

View reviewed changes

packages/adapter-nextjs/src/auth/handlers/handleSignOutCallbackRequest.ts Show resolved Hide resolved

AllanZhengYP reviewed Dec 23, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(adapter-nextjs): server-side auth flows integrating cognito hosted UI #13827

feat(adapter-nextjs): server-side auth flows integrating cognito hosted UI #13827

HuiSF commented Sep 19, 2024

HuiSF Sep 19, 2024

HuiSF Sep 19, 2024

HuiSF Sep 19, 2024

HuiSF Sep 19, 2024

jjarvisp left a comment

jjarvisp Nov 29, 2024

HuiSF Dec 21, 2024

AllanZhengYP Dec 23, 2024

AllanZhengYP Dec 23, 2024

HuiSF Dec 26, 2024

AllanZhengYP Dec 23, 2024

HuiSF Dec 26, 2024

AllanZhengYP Dec 23, 2024

HuiSF Dec 26, 2024

AllanZhengYP Dec 23, 2024

HuiSF Dec 26, 2024

HuiSF Dec 27, 2024

AllanZhengYP Dec 23, 2024

HuiSF Dec 26, 2024

feat(adapter-nextjs): server-side auth flows integrating cognito hosted UI #13827

Are you sure you want to change the base?

feat(adapter-nextjs): server-side auth flows integrating cognito hosted UI #13827

Conversation

HuiSF commented Sep 19, 2024

Description of changes

Issue #, if available

Description of how you validated changes

Checklist

Checklist for repo maintainers

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jjarvisp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment