Comments (8)
If you're not receiving a JWT as an access_token
, then you're probably missing the step where you declare your custom audience: https://auth0.com/docs/quickstart/spa/angular2/02-calling-an-api#modify-the-authservice-class
from auth0-spa-js.
If your access_token is not a JWT, it means that you're not using a custom audience. Please check our guidance for calling an api here.
from auth0-spa-js.
Also, if you don't want to use a custom audience, you can send the access_token
and then use https://github.com/auth0/node-auth0 to get the user information using the getProfile
method.
from auth0-spa-js.
Created a new API, still get malformed error when supplying that API as the audience.
// AUTH0_AUDIENCE is the custom API I just created
const client = jwksClient({
jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`
});
const getKey = (header: any, callback: any) => {
client.getSigningKey(header.kid, (_err: Error, key: jwksClient.SigningKey) => {
const signingKey = (key as jwksClient.CertSigningKey).publicKey || (key as jwksClient.RsaSigningKey).rsaPublicKey
callback(null, signingKey)
})
}
const options = {
audience: `${process.env.AUTH0_AUDIENCE}`,
issuer: `https://${process.env.AUTH0_DOMAIN}/`,
algorithms: ['RS256']
};
const apollo = new ApolloServer({
modules: [graphQLRoot],
context: (context: any) => {
let token = context.req.headers.authorization;
token = token ? token.replace('Bearer ', '') : null
if (token) {
const user = new Promise((resolve, reject) => {
jwt.verify(token, getKey, options, (_err, decoded) => {
console.log('err', _err)
console.log('decoded', decoded)
resolve(decoded);
});
});
return {
currentUser: user
}
} else {
return {
currentUser: undefined
}
}
}
}
from auth0-spa-js.
I feel like the app on auth0 should know the API exists, but I don't see anywhere to tell it that?
from auth0-spa-js.
I was wondering the exact same thing -- does my API have to have some kind of /token
endpoint or something? I thought Auth0 handled all of that? Here's our flow:
- Angular app creates Auth0 client which, after login, does somewhere make a call to
{domain}.auth0.com/oauth/token
in which I see the token and id_token, but we can't actually get to it. - If I call the API with the
token
, I get a JWT malformed error. - If I call the API with the
id_token
, the audience is wrong.
What am I missing here?
from auth0-spa-js.
In order to get a JWT as the access_token
, your request should have something in the audience
param. So, the first request to /authorize
will be something like https://yourtenant.auth0.com/authorize?client_id=YOUR_CLIENT&audience=YOUR_API....
(not necessarily in that order).
from auth0-spa-js.
@luisrudge also saw your other comment -- here's what I have for my service:
private config = {
domain: AUTH0_AUTH_ISSUER,
client_id: AUTH0_CLIENT_IDS.GLOBAL,
redirect_uri: `${window.location.origin}/${AUTH0_REDIRECT_URI}`
};
from auth0-spa-js.
Related Issues (20)
- "Misconfiguration in the system or a service outage" error in Auth0 HOT 3
- prompt in authorizationParams is not getting override. It is coming none even if it is set to other value like login. HOT 7
- Sophos Cyber Security Endpoint detects ransomware in the package HOT 3
- Total Cookie Protection breaks auth HOT 2
- Better error messaging when out of local storage quota? HOT 4
- Angular SSR window.crypto HOT 1
- User without Organization Membership caused infitine login redirect loop HOT 2
- NullInjectorError HOT 1
- Use '.well-known/openid-configuration' to configure Auth0Provider (Auth0Client) calls HOT 6
- Clarify limits for checkSession method HOT 7
- React Quickstart causing error upon clicking the login button HOT 2
- organization option of Auth0Client.getTokenSilently function is unexpectedly reuse previous value HOT 4
- Make getTokenSilently Generic HOT 2
- Support `getAccessTokenSilently` for multiple audiences in parallel HOT 4
- auth0-spa-js for multipage app? HOT 3
- Suport for multi tab sessions HOT 5
- Add configuration option for custom transaction storage
- LoginWithPopup doesn't work in Microsoft Word add-in on Mac HOT 3
- Extra redirect on silent login after upgrade to v2 HOT 9
- Implicit return in auth0-spa-js/src/cache /cache-manager.ts when TS "noImplicitReturns" is set to true HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from auth0-spa-js.