Parameter 'code_verifier' is required (Auth0)

[piidun]

I have setup auth0 as my provider according to the documentation.
After being redirected from the login, I get to an infinite redirect loop.

I see this in the console:
invalid_request: Parameter 'code_verifier' is required

I don't see how or where this parameter supposed to be set in Nuxt oidc config.

Reproduce: Set up an app in auth0, do the correct the grant settings, set redirect URI etc. Add Nuxt-oidc-auth in a new Nuxt project. Add the standard auth0 configuration from the docs. Add the clientid/client secret etc.

[itpropro]

The code_verifier field is part of the PKCE exchange. Did you maybe not configure PKCE?

[piidun]

Thanks for the response. I thought that PKCE was already set up as it is default?

Anyway, I tried to configure it as a generic OIDC but nothing worked. Suddenly, I noticed that it works in chrome and not safari. I have no idea why.

I will attempt back-track my way from the generic OIDC settings, into the correct configuration for auth0 as a pre-configured provider. Then I will see what the issue might be in Safari. I'm guessing some old cookies/sessions lying around messing things up. Or maybe it's not creating the session cookie.

[itpropro]

Feel free to share your configuration, I can test it against my Auth0 instance.

[piidun]

Feel free to share your configuration, I can test it against my Auth0 instance.

I have found that there is no issue with the config. It works in Chrome with the config according to the documentation.

I did however manage to recreate the redirect loop issue in Chrome, by setting this in nuxt.config.ts:

session: { cookie: { sameSite: 'strict' },

It works fine with lax/none. But in Safari, it makes no difference. Still get the redirect loop and code_verifier issue.

It seems that Safari treats cookie policy as strict no matter what is set. This is a safari problem. But auth0 will always be the external cookie issuer so as it stands it will not work in Safari, unless I set up some sort of proxy.

Perhaps there is a simple work around for this? (That is not setting up a proxy)

[itpropro]

Cookie setting set to lax should be fine from a security standpoint, having this with the strict setting would be expected behavior in the auth0 case.