From 3d16b1d0b4a0ecddac5d9099ef4657f9d9f09ba9 Mon Sep 17 00:00:00 2001 From: Satindar Dhillon Date: Sun, 28 Aug 2022 09:36:30 -0700 Subject: [PATCH 1/3] add redirect uri for android apple login --- .../api/src/routers/auth/mobile/mobile_auth_router.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/packages/api/src/routers/auth/mobile/mobile_auth_router.ts b/packages/api/src/routers/auth/mobile/mobile_auth_router.ts index 50890aaab..7bd0c20e9 100644 --- a/packages/api/src/routers/auth/mobile/mobile_auth_router.ts +++ b/packages/api/src/routers/auth/mobile/mobile_auth_router.ts @@ -11,6 +11,7 @@ import { createMobileEmailSignUpResponse, } from './sign_up' import { createMobileAccountCreationResponse } from './account_creation' +import { env } from '../../../env' export function mobileAuthRouter() { const router = express.Router() @@ -60,5 +61,12 @@ export function mobileAuthRouter() { res.status(payload.statusCode).json(payload.json) }) + router.post('/android-apple-redirect', (req, res) => { + const { id_token } = req.body + return res.redirect( + `${env.client.url}/android-apple-token?token=${id_token as string}` + ) + }) + return router } From a720d5a5d58df0339bee7807338eea1e15046720 Mon Sep 17 00:00:00 2001 From: Satindar Dhillon Date: Sun, 28 Aug 2022 09:48:39 -0700 Subject: [PATCH 2/3] set cors config for android web redirect --- .../api/src/routers/auth/mobile/mobile_auth_router.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/packages/api/src/routers/auth/mobile/mobile_auth_router.ts b/packages/api/src/routers/auth/mobile/mobile_auth_router.ts index 7bd0c20e9..c43df9bc8 100644 --- a/packages/api/src/routers/auth/mobile/mobile_auth_router.ts +++ b/packages/api/src/routers/auth/mobile/mobile_auth_router.ts @@ -12,6 +12,8 @@ import { } from './sign_up' import { createMobileAccountCreationResponse } from './account_creation' import { env } from '../../../env' +import { corsConfig } from '../../../utils/corsConfig' +import cors from 'cors' export function mobileAuthRouter() { const router = express.Router() @@ -61,6 +63,12 @@ export function mobileAuthRouter() { res.status(payload.statusCode).json(payload.json) }) + // Required since this will be called from Android WebView + router.options( + '/android-apple-redirect', + cors({ ...corsConfig, maxAge: 600 }) + ) + router.post('/android-apple-redirect', (req, res) => { const { id_token } = req.body return res.redirect( From 3f6ade9614b335cd5b9aacd5cd77dcad91a92175 Mon Sep 17 00:00:00 2001 From: Satindar Dhillon Date: Sun, 28 Aug 2022 09:55:41 -0700 Subject: [PATCH 3/3] verify apple token with both audience names used for the app --- packages/api/src/routers/auth/apple_auth.ts | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/packages/api/src/routers/auth/apple_auth.ts b/packages/api/src/routers/auth/apple_auth.ts index 07404924a..c11fef607 100644 --- a/packages/api/src/routers/auth/apple_auth.ts +++ b/packages/api/src/routers/auth/apple_auth.ts @@ -41,8 +41,7 @@ async function fetchApplePublicKey(kid: string): Promise { } export async function decodeAppleToken( - token: string, - isWeb?: boolean + token: string ): Promise { const decodedToken = jwt.decode(token, { complete: true }) const { kid, alg } = (decodedToken as any).header @@ -54,8 +53,8 @@ export async function decodeAppleToken( } const jwtClaims: any = jwt.verify(token, publicKey, { algorithms: [alg] }) const issVerified = (jwtClaims.iss ?? '') === appleBaseURL - const audVerified = - (jwtClaims.aud ?? '') === isWeb ? webAudienceName : audienceName + const audience = jwtClaims.aud ?? '' + const audVerified = audience == webAudienceName || audience === audienceName if (issVerified && audVerified && jwtClaims.email) { return { email: jwtClaims.email, @@ -106,7 +105,7 @@ export async function handleAppleWebAuth( return env.client.url } - const decodedTokenResult = await decodeAppleToken(idToken, true) + const decodedTokenResult = await decodeAppleToken(idToken) const authFailedRedirect = `${baseURL()}/login?errorCodes=${ LoginErrorCode.AuthFailed }`