nextauthjs / nextauthjs/next-auth

MS Graph token.access_token missing when using Chrome or Safari but works in Edge

Open
#7,646 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

providers triage
Dominant language
TypeScript
Stars
28.4k
Forks
4k
PR merge metrics
No merged PRs in 30d

Description

Provider type

Azure Active Directory

Environment

System:
OS: macOS 13.3.1
CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
Memory: 335.19 MB / 16.00 GB
Shell: 5.9 - /bin/zsh
Binaries:
Node: 18.15.0
npm: 9.5.0
Browsers:
Chrome: 113.0.5672.126
Safari: 16.4
NPM Packages
react: 18.2.0
next: ^13.4.3
next-auth: ^4.22.1

Reproduction URL

https://github.com/ryub3n/next-auth-azuread

Describe the issue

Next Auth with AzureAD provider is not setting up tokens properly in Chrome and Safari

Check the token logged in this line

When using Edge we get token.access_token along with token.accessToken
token.access_token can be used to call the graph api

When using Chrome or Safari token.access_token is missing

How to reproduce

Use the repo provided and add the environment variables as mentioned in the .env.sample

Or

  • Setup a NextJS Typescript app with Next-Auth and AzureAD Provider
  • Use the token.access_token to access graph API resourcs
  • This works on Edge but not in Chrome and Safari as the token.acces_token is missing
Expected behavior

Since the profile picture is fetched using the tokens.access_token this should be available in the token.
For some reason I'm not able to access the tokenset used when getting the profile picture.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reproduction repository and pages/api/auth/[...nextauth].ts at the linked line, then follow the .env.sample setup. Compare the token output in Chrome, Safari, and Edge, focusing on token.access_token and the profile-picture or Graph API request. Done means the browser-specific behavior and the token availability are confirmed with a reproducible test.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, nextjs, react, typescript
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.