Auth-module: Auth0 scheme throw error when user is logged out: ExpiredAuthSessionError: Both token and refresh token have expired. Your request was aborted.

[bordagabor]

Version

module: 5.0.0-1617968180.f699074
nuxt: 2.14.6

Nuxt configuration

mode:

• [x] universal
• [x] spa

Nuxt configuration

 auth: {
    redirect: {
      login: '/',
      callback: '/sign-in',
    },
    strategies: {
      local: false,
      auth0: {
        domain: process.env.AUTH0_DOMAIN,
        clientId: process.env.AUTH0_CLIENT_ID,
        audience: process.env.AUTH0_AUDIENCE,
        scope: ['openid', 'profile', 'email', 'offline_access'],
        responseType: 'code',
        grantType: 'authorization_code',
        codeChallengeMethod: 'S256',
      },
    },
  },

Reproduction

With the configuration settings above Axios cannot call any (public) API endpoint and got error in logged out state.

What is expected?

Axios shuld call public API endpoints even in logged out state.

What is actually happening?

The Authorization header is set to string 'false' and this cause the error.

Steps to reproduce

1. Setup Auth0 integration
2. Setup PCKE flow
3. Call any API in logged out state

[bordagabor]

PR:
https://github.com/nuxt-community/auth-module/pull/1119

[xFEARx]

I have the same bug, please merge PR

[DudaevAR]

@JoaoPedroAS51 ping

[JoaoPedroAS51]

Hey guys! Thank you for reporting this issue. I would like to know if someone could make a repro in CodeSandbox using this template? It would help me a lot. Thank you in advance :)

I checked the PR, but I think it's just a workaround for the real issue. If the Authorization header is being set to false as string and not as boolean, it means that it couldn't remove the token correctly on logout. Therefore, we must find out why.

Now what we can certainly do is throw a different error when that happens. Something like "Authorization header couldn't be removed". This way would prevent the "ExpiredAuthSessionError" from being thrown, which is the wrong error for this issue.

[DudaevAR]

This problem has existed for a long time, six months ago I tried to solve it, but it did not give any progress in solving this problem
https://github.com/nuxt-community/auth-module/pull/685

[bordagabor]

@JoaoPedroAS51 Hello, I dig a bit deeper and I found that reset function never call removeUniversal since it passed false witch does not met with the condition isUnset. This way the application was able to set header from cookie and local storage after logout. I just updated my PR based on this, and seems this is working as expected now. Please check:
https://github.com/nuxt-community/auth-module/pull/1119

[DudaevAR]

In my case, the problem was in two interceptors after authorization: the first had the required schema and the correct token, and the second had the wrong schema and the token was missing. After the second, an error appeared. That is, after login, if the interceptor was not reset, strange things happened.
As a workaround, you can call $auth.reset ({resetInterceptor: true}); before authorization.
But it seems to me that it would be more correct to do a check for the voidness of the interceptor in the initializeRequestInterceptor and clear it.

[JoaoPedroAS51]

In my case, the problem was in two interceptors after authorization: the first had the required schema and the correct token, and the second had the wrong schema and the token was missing. After the second, an error appeared. That is, after login, if the interceptor was not reset, strange things happened.
As a workaround, you can call $auth.reset ({resetInterceptor: true}); before authorization.
But it seems to me that it would be more correct to do a check for the voidness of the interceptor in the initializeRequestInterceptor and clear it.

Hi @DudaevAR! Can you open a new issue to report this? Thank you in advance :)

[bordagabor]

I going to close this issue since the problem was in my code. To set cookie in SSR mode I use this function in store/index.js:

import * as Cookies from 'cookies'

export const actions = {
  nuxtServerInit(ctx, { req, app }) {
    const cookies = new Cookies(req)
    const cookieValue = cookies.get('auth._token.auth0')
    const token = cookieValue ? decodeURI(cookieValue) : false
    app.$axios.setToken(token)
  },
}

The problem with the cookies.get is this function is read false value as string.