aws-amplify / aws-amplify/amplify-cli

Generated Hosted UI domain too long for Sign In with Apple

Open
#11,483 8 comments 1 reaction 0 assignees View on GitHub
auth documentation extensibility feature-request p3
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### Before opening, please confirm:

- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/dev/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

v16.13.2

### Amplify CLI Version

10.5.1

### What operating system are you using?

Mac

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No

### Amplify Categories

auth

### Amplify Commands

Not applicable

### Describe the bug

When configuring OAuth/Cognito Hosted UI using the `amplify auth add` command, the CLI generated a domain for the Hosted UI resource. The full domain will typically look something like this:
```https://-.auth.us-west-2.amazoncognito.com```

It appears that this domain violates a character count limitation set by Apple, when integrating Hosted UI with Sign In With Apple:

From [this](https://developer.apple.com/forums/thread/122536) Apple forums thread:

```terminal
We were able to fix this issue with the following steps:

Add domain/subdomain and return URL to your Apple account
Check the length of the domain in redirect_uri it shouldn't be too long
In our case, domain length was 54 symbols and it start working when we reduce it to 49 symbols. It looks like there is a limit to the domain name length of around 50 symbols.

It was easy to reach this limit since we use a Cognito domain with a prefix and prefix attached to quite long domain name ".auth.eu-central-1.amazoncognito.com".
```

I have reproduced this issue by using the domain set by the CLI, which causes the `Invalid redirect_uri` error on the Sign In With Apple UI. After manually modifying the domain length in Cognito console and in my amplify config, Sign In With Apple works correctly.

### Expected behavior

The CLI should create a domain that can be consumed by all identity providers that are supported out of the box by Cognito.

### Reproduction steps

1. Init an amplify project and add auth, choosing the OAuth option. Add Sign In With Apple.
2. Follow all instructions for SIWA from the [Amplify docs](https://docs.amplify.aws/lib/auth/social/q/platform/react-native/).
3. Attempt to login.
4. Note the redirect_uri error.
5. Change the domain in Cognito and in the amplify config, to something random/unique but very short.
6. Attempt to login. It should be successful.

### GraphQL schema(s)

```graphql
# Put schemas below this line

```

### Project Identifier

_No response_

### Log output

```
# Put your logs below this line

```

### Additional information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the auth flow behind `amplify auth add` and the generated Hosted UI domain, then compare the value stored in the Amplify config with the Cognito domain shown in the console. Reproduce the Sign In with Apple `Invalid redirect_uri` error using the listed steps. Done means a generated domain stays within Apple's apparent length limit while remaining unique and usable by supported Cognito identity providers.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.