firebase / firebase/firebase-js-sdk

MISSING_OR_INVALID_NONCE : The nonce in ID Token does not match the SHA256 hash of the raw nonce in the request

Open
#8,207 0 comments 0 reactions 0 assignees View on GitHub
api: auth needs-attention question stack:Angular
Dominant language
TypeScript
Stars
5.1k
Forks
1k
Avg merge
2d 21h
Merged PRs (30d)
37

Description

### Operating System

windows10

### Browser Version

chrome

### Firebase SDK Version

1.7.2

### Firebase SDK Product:

Auth

### Describe your project's tooling

Angular 16 single page application

### Describe the problem

I am trying to authenticate into firebase using keycloak as OIDC. I am using authorization code flow of the firebase configuration. Below is the code that I have written for the same.

Upon calling this block of code I'm getting following error "MISSING_OR_INVALID_NONCE : The nonce in ID Token does not match the SHA256 hash of the raw nonce in the request.". If anyone from the community knows, any guidance would be appreciated.

I have tried adding rawNonce field but it's giving the same error, also I tried disabling the NONCE field from the keycloak dashboard.

### Steps and code to reproduce issue

const provider = new OAuthProvider('oidc.kc-dev');

const credential = provider.credential({
idToken: id_token
accessToken: access,
});

signInWithCredential(getAuth(), credential)
.then((result: any) => {
// Get the OAuth access token and ID Token
const credential1 = OAuthProvider.credentialFromResult(result);
console.log(credential1);
})
.catch((error: any) => {
// Handle error.
});

Contributor guide

Open the contributing guide

Research direction

Start with the OAuthProvider.credential and signInWithCredential entry points shown in the report, then trace how the ID token and raw nonce are validated. Reproduce the Angular 16 Keycloak OIDC authorization-code flow with the provided credential shape and document the required nonce handling or a confirmed SDK defect; the report currently omits a complete reproduction and expected behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
angular, typescript
Domain
authentication, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.