FusionAuth - Handle www-authenticate challenges as needed

Provider type

FusionAuth

Environment

System:
OS: macOS 13.4.1
CPU: (12) arm64 Apple M2 Pro
Memory: 1.70 GB / 32.00 GB
Shell: 5.9 - /bin/zsh
Binaries:
Node: 20.6.1 - /opt/homebrew/bin/node
npm: 9.8.1 - /opt/homebrew/bin/npm
pnpm: 8.7.6 - /opt/homebrew/bin/pnpm
Browsers:
Brave Browser: 117.1.58.129
Chrome: 117.0.5938.92
Safari: 16.5.1

"dependencies": {
"@auth/core": "latest",
"@auth/sveltekit": "latest"
},

Reproduction URL

https://github.com/alex-fusionauth/fusionauth-sveltekit

Describe the issue

Trying to find why Auth.js is throwing TODO: Handle www-authenticate challenges as needed. It appears that in the package oauth4webapi the method parseWwwAuthenticateChallenges is called and brings back WWW-Authenticate header from the code grant response. This has scheme:'basic' listed which causes the error.

Origin of issue

    let challenges;
    if ((challenges = o.parseWwwAuthenticateChallenges(codeGrantResponse))) {
        for (const challenge of challenges) {
            console.log("challenge", challenge);
        }
        throw new Error("TODO: Handle www-authenticate challenges as needed");
    }

Should the user or FusionAuth be handling this somehow?

How to reproduce

You will need docker.

1. run docker compose up -d
2. cd complete-example
3. copy .env.example to .env
4. npm run dev
5. click sing in button
6. sign in using richard@example.com with password: password

Chooose provider while signing in

Error thrown:

challenge { scheme: 'basic', parameters: {} }
[auth][error][CallbackRouteError]: Read more at https://errors.authjs.dev#callbackrouteerror
[auth][cause]: Error: TODO: Handle www-authenticate challenges as needed
    at handleOAuth (file:///Users/afa/dev/inversoft/fusionauth/fusionauth-quickstart-javascript-sveltekit-web/complete-application/node_modules/@auth/sveltekit/node_modules/@auth/core/lib/oauth/callback.js:69:15)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Module.callback (file:///Users/afa/dev/inversoft/fusionauth/fusionauth-quickstart-javascript-sveltekit-web/complete-application/node_modules/@auth/sveltekit/node_modules/@auth/core/lib/routes/callback.js:20:41)
    at async AuthInternal (file:///Users/afa/dev/inversoft/fusionauth/fusionauth-quickstart-javascript-sveltekit-web/complete-application/node_modules/@auth/sveltekit/node_modules/@auth/core/lib/index.js:65:38)
    at async Proxy.Auth (file:///Users/afa/dev/inversoft/fusionauth/fusionauth-quickstart-javascript-sveltekit-web/complete-application/node_modules/@auth/sveltekit/node_modules/@auth/core/index.js:100:30)
    at async Module.respond (/Users/afa/dev/inversoft/fusionauth/fusionauth-quickstart-javascript-sveltekit-web/complete-application/node_modules/@sveltejs/kit/src/runtime/server/respond.js:282:20)
    at async file:///Users/afa/dev/inversoft/fusionauth/fusionauth-quickstart-javascript-sveltekit-web/complete-application/node_modules/@sveltejs/kit/src/exports/vite/dev/index.js:510:22
[auth][details]: {
  "provider": "fusionauth"
}

Expected behavior

There should be no error. Login should continue as the AuthToken is good.

Start with the OAuth callback path shown in the stack trace, especially @auth/core/lib/oauth/callback.js around the www-authenticate challenge handling. Reproduce the FusionAuth flow with docker compose and the complete-example steps, then verify that a valid AuthToken allows login to continue without the TODO error.