sfc-gh-bhess/st_oauth

OAuth component for Streamlit

st_oauth's Issues

Not able to get access token

The post request is incomplete and doesn't get the access tokens to verify

The token is not yet valid (iat) aka add leeway config

Hi Brian,

thanks for the project, it's great!!!!

In our setup unfortunately the clocks are not 100% synchronized as it turns out :)
Our KeyCloak is 0.5s in the future to our client application, this is a problem for PyJWT specially since version 2.6.0: jpadilla/pyjwt#824

File "/usr/local/lib/python3.10/dist-packages/jwt/api_jwt.py", line 210, in decode
    decoded = self.decode_complete(
  File "/usr/local/lib/python3.10/dist-packages/jwt/api_jwt.py", line 162, in decode_complete
    self._validate_claims(
  File "/usr/local/lib/python3.10/dist-packages/jwt/api_jwt.py", line 242, in _validate_claims
    self._validate_iat(payload, now, leeway)
  File "/usr/local/lib/python3.10/dist-packages/jwt/api_jwt.py", line 280, in _validate_iat
    raise ImmatureSignatureError("The token is not yet valid (iat)")
jwt.exceptions.ImmatureSignatureError: The token is not yet valid (iat)

I'm preparing a fix, but I do not understand something, which is also related to: #2

Why do you have 'jwt' in install_requires and not PyJWT, the code seem to use jwt.PyJWKClient which is AFAIK only available in PyJWT?

Please replace st.experimental_get_query_params with st.query_params

With recent versions of Streamlit (streamlit==1.30.0), the login shows

Please replace st.experimental_get_query_params with st.query_params.

st.experimental_get_query_params will be removed after 2024-04-11.

Refer to our [docs page](https://docs.streamlit.io/library/api-reference/utilities/st.query_params) for more information.

Please replace st.experimental_get_query_params with st.query_params.

st.experimental_get_query_params will be removed after 2024-04-11.

Refer to our [docs page](https://docs.streamlit.io/library/api-reference/utilities/st.query_params) for more information.

DecodeError with Auth0

Hi, I'm getting this error using Auth0 as the OAuth provider:

DecodeError: Invalid payload string: 'utf-8' codec can't decode byte 0xf4 in position 1: invalid continuation byte

coming from st_oauth.py on line 51:
signing_key = jwks_client(config['jwks_uri']).get_signing_key_from_jwt(token['access_token'])

snowauth_session()

I am currently supporting a multipage app and need to validate session state prior to loading each page. I'm not seeing any function in the library called snowauth_session() to handle this validation.

AttributeError: module 'jwt' has no attribute 'PyJWKClient'

Recieving the following error:
AttributeError: module 'jwt' has no attribute 'PyJWKClient'

Have rolled back to 3.8 from 3.9 (missed this on the GIT page) and tried PyJWT 2.7.0 and 2.6.0 as I saw something about a change.

DecodeError: Not enough segments

Hello, getting that error. Seems like it has to do with this line: signing_key = jwks_client(config['jwks_uri']).get_signing_key_from_jwt(token['access_token'])

And I'm not sure but maybe it also has to do with the audience parameter? What's the proper value for this when using GmailAPI?

Regarding parameters

Just wondering if these parameters are necessary since my provider doesn't seem to have these,

audience - the audience as configured in the OAuth provider
identity_field_in_token - which field in the returned token that contains the identity (usually it is sub or upn). This is the field that will be returned from the st_oauth() call.

Error with code challenge

Hi. I get this error when trying to implement this authorization package:

error:invalid_request
error_description:The mandatory 'code_challenge' parameter is missing.
error_uri:https://documentation.openiddict.com/errors/ID2029

How would I include a code challenge parameter?