Login code verifier challenge B2C

[Anthonyflume]

Hey guys,

noticed when you click login then go back to where the login was initiated then click login again with Azure B2C we get an issue about not providing a code verifier challenge.

to solve this we had to implement this code to resolve it

const cookiepcke = useCookie('nuxt-auth-pkce'); cookiepcke.value = null; const cookiestate = useCookie('nuxt-auth-state'); cookiestate.value = null;

please let us know if we did anything wrong with implementing the package

[satriaajiputra]

Yes, i think its because of this, and it might happen in other OAuth providers too.

I tried to fork this repo for my project and make some edits to the handlePkceVerifier and handleState method to prevent that issue. But i dont know if this sacrifices the security or not. Could someone verify it?

function getOAuthFlowState(event: H3Event) {
  const query = getQuery<{ code?: string; error?: string; state?: string }>(event)
  const isInitiation = !query.code && !query.error // Initiation: no code/error
  const isCallback = !!query.code // Callback: has code
  const hasError = !!query.error // Error: always cleanup
  return { query, isInitiation, isCallback, hasError }
}

export async function handlePkceVerifier(event: H3Event) {
  const { isInitiation, isCallback, hasError } = getOAuthFlowState(event)
  let verifier = getCookie(event, 'nuxt-auth-pkce')

  if (hasError || (isInitiation && verifier)) {
    // FIX: Auto-cleanup stale verifier if initiation (back button case) or error
    deleteCookie(event, 'nuxt-auth-pkce')
    verifier = undefined
  }

  if (verifier && isCallback) {
    // Callback mode: Get verifier, delete cookie, return partial (for token exchange)
    deleteCookie(event, 'nuxt-auth-pkce')
    return { code_verifier: verifier }
  }

  // Create new verifier
  verifier = encodeBase64Url(getRandomBytes())
  setCookie(event, 'nuxt-auth-pkce', verifier)

  // Get pkce
  const encodedPkce = new TextEncoder().encode(verifier)
  const pkceHash = await subtle.digest('SHA-256', encodedPkce)
  const pkce = encodeBase64Url(new Uint8Array(pkceHash))

  return {
    code_verifier: verifier,
    code_challenge: pkce,
    code_challenge_method: 'S256',
  }
}

export async function handleState(event: H3Event) {
  const { isInitiation, isCallback, hasError } = getOAuthFlowState(event)
  let state = getCookie(event, 'nuxt-auth-state')

  // CORE FIX: Auto-cleanup stale state if initiation (back/multiple click case) or error
  if (hasError || (isInitiation && state)) {
    deleteCookie(event, 'nuxt-auth-state')
    state = undefined
  }

  // Callback mode: Return existing state for comparison (if present; handler will cleanup later)
  if (isCallback) {
    if (!state) {
      // Edge case: Code present but no state cookie (e.g., tampering/session loss)
      // Return empty; handler will catch mismatch and error
      return ''
    }
    // Do not delete here: Allow comparison + audit in handler
    return state
  }

  state = encodeBase64Url(getRandomBytes(8))
  setCookie(event, 'nuxt-auth-state', state)
  return state
}