React-native-apple-authentication: SHA256 Nonce

[dburdan]

I noticed in this library the nonce provided to appleAuth.performRequest is automatically SHA256-hashed. I didn't see this documented anywhere which can lead to some confusion when building out server-side verification.

Is there a reason for this beyond a Firebase Auth requirement? Unless I'm overlooking something, it would be nice to allow passing raw values for use with other implementations.

[mikehardy]

It's a straight implementation of the firebase apple sign-in documented method AFAIK: https://firebase.google.com/docs/auth/ios/apple#sign_in_with_apple_and_authenticate_with_firebase

[A-Tokyo]

I handled it serverside by doing

    appleIdTokenClaims = await appleSigninAuth.verifyIdToken(id_token, {
      /** sha256 hex hash of raw nonce - https://github.com/invertase/react-native-apple-authentication/issues/28 */
      nonce: nonce ? crypto.createHash('sha256').update(nonce).digest('hex') : undefined,
    });

[mikehardy]

Is there anything really actionable here? I hate to leave things just sitting open even if they are good ideas. If users want to contribute PRs that's awesome but having a work queue in a volunteer project is just a good way to bury oneself - not worth it.

PRs accepted of course though, anyone wants to, we review everything :-)

[A-Tokyo]

Should we at least add this to the documentation? 💪 @mikehardy

[mikehardy]

@A-Tokyo

PRs accepted of course though, anyone wants to, we review everything :-)

:-)

[A-Tokyo]

@mikehardy Done 🚀 https://github.com/invertase/react-native-apple-authentication/pull/73