aws-amplify / aws-amplify/amplify-cli
Generated Hosted UI domain too long for Sign In with Apple
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
### Before opening, please confirm:
- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/dev/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.
### How did you install the Amplify CLI?
npm
### If applicable, what version of Node.js are you using?
v16.13.2
### Amplify CLI Version
10.5.1
### What operating system are you using?
Mac
### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
No
### Amplify Categories
auth
### Amplify Commands
Not applicable
### Describe the bug
When configuring OAuth/Cognito Hosted UI using the `amplify auth add` command, the CLI generated a domain for the Hosted UI resource. The full domain will typically look something like this:
```https://-.auth.us-west-2.amazoncognito.com```
It appears that this domain violates a character count limitation set by Apple, when integrating Hosted UI with Sign In With Apple:
From [this](https://developer.apple.com/forums/thread/122536) Apple forums thread:
```terminal
We were able to fix this issue with the following steps:
Add domain/subdomain and return URL to your Apple account
Check the length of the domain in redirect_uri it shouldn't be too long
In our case, domain length was 54 symbols and it start working when we reduce it to 49 symbols. It looks like there is a limit to the domain name length of around 50 symbols.
It was easy to reach this limit since we use a Cognito domain with a prefix and prefix attached to quite long domain name ".auth.eu-central-1.amazoncognito.com".
```
I have reproduced this issue by using the domain set by the CLI, which causes the `Invalid redirect_uri` error on the Sign In With Apple UI. After manually modifying the domain length in Cognito console and in my amplify config, Sign In With Apple works correctly.
### Expected behavior
The CLI should create a domain that can be consumed by all identity providers that are supported out of the box by Cognito.
### Reproduction steps
1. Init an amplify project and add auth, choosing the OAuth option. Add Sign In With Apple.
2. Follow all instructions for SIWA from the [Amplify docs](https://docs.amplify.aws/lib/auth/social/q/platform/react-native/).
3. Attempt to login.
4. Note the redirect_uri error.
5. Change the domain in Cognito and in the amplify config, to something random/unique but very short.
6. Attempt to login. It should be successful.
### GraphQL schema(s)
```graphql
# Put schemas below this line
```
### Project Identifier
_No response_
### Log output
```
# Put your logs below this line
```
### Additional information
_No response_
Contributor guide
Research direction
Start with the auth flow behind `amplify auth add` and the generated Hosted UI domain, then compare the value stored in the Amplify config with the Cognito domain shown in the console. Reproduce the Sign In with Apple `Invalid redirect_uri` error using the listed steps. Done means a generated domain stays within Apple's apparent length limit while remaining unique and usable by supported Cognito identity providers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- authentication, cli, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100