github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #1210] Okta auth fails with PKCE code challenge error even when pkce is explicitly configured to false #8643

New Issue
Closed
opened 2026-04-13 03:47:31 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-13 03:47:31 -05:00
Owner
Copy Link

Originally created by @paambaati on GitHub (Jan 14, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/1210

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Follow documentation and set up the GenericOAuthPlugin like this –

    plugins: [
  genericOAuth({
    config: [
      {
        providerId: 'okta',
        clientId: process.env.OKTA_CLIENT_ID,
        clientSecret: process.env.OKTA_CLIENT_SECRET,
        discoveryUrl: new URL('/.well-known/openid-configuration', process.env.OKTA_ISSUER).href,
        scopes: ['openid', 'email', 'profile'],
        pkce: false,
      },
    ],
  }),
]

  2. Login via the UI.

    await signIn.oauth2({
    providerId: 'okta',
    callbackURL: '/dashboard',
  });

  3. Be presented with this error.
    Screenshot 2025-01-14 at 10 30 40 PM

Current vs. Expected behavior

The expected behavior is login should work seamlessly. However, I get this error –

 ERROR [Better Auth]:  { error: 'invalid_request',
  error_description:
   'PKCE code challenge should be specified in the authorize request for code verification.',
  status: 400,
  statusText: 'Bad Request' }

Here's what I see on the browser console –

Screenshot 2025-01-14 at 10 40 21 PM 
POST http://localhost:3000/api/auth/sign-in/oauth2

200 OK
{
    "url": "https://abc.oktapreview.com/oauth2/v1/authorize?response_type=code&client_id=0oaj5irt3th0EhakA1d7&state=dMR147gkpAZcnsp2LFRPl7s-kj1Fhtpp&scope=openid+email+profile&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Foauth2%2Fcallback%2Fokta",
    "redirect": true
}

GET https://abc.oktapreview.com/oauth2/v1/authorize?response_type=code&client_id=0oaj5irt3th0EhakA1d7&state=dMR147gkpAZcnsp2LFRPl7s-kj1Fhtpp&scope=openid email profile&redirect_uri=http://localhost:3000/api/auth/oauth2/callback/okta

302

<html page with Error Code: oauth_code_verification_failed/>

GET http://localhost:3000/api/auth/get-session

200 OK
null

GET http://localhost:3000/api/auth/oauth2/callback/okta?code=jJumX8_TBDNKWDuEnm7kOFTtdffi2J7Q6VRLmrKKb5Q&state=dMR147gkpAZcnsp2LFRPl7s-kj1Fhtpp

302

<html page with Error Code: oauth_code_verification_failed/>

GET http://localhost:3000/api/auth/error?error=oauth_code_verification_failed

200 OK

<html page with Error Code: oauth_code_verification_failed/>

What version of Better Auth are you using?

1.1.12

Provide environment information

- OS: macOS Sequoia 15.2
- Browser: Mozilla Firefox 134.0

Which area(s) are affected? (Select all that apply)

Backend, Client

Auth config (if applicable)

import { betterAuth } from 'better-auth';
import { prismaAdapter } from 'better-auth/adapters/prisma';
import { genericOAuth } from 'better-auth/plugins';
import { usePrisma } from '~/server/services/use-prisma';

const prisma = usePrisma();

export const auth = betterAuth({
  database: prismaAdapter(prisma, {
    provider: 'postgresql',
  }),
  advanced: {
    // We'll let the default primary fields on PostgreSQL generate this themselves.
    generateId: false,
  },
  user: {
    modelName: 'User',
    fields: {
      name: 'displayName',
      image: 'imageSrc',
    },
    additionalFields: {
      firstName: {
        type: 'string',
        fieldName: 'firstName',
        returned: true,
        input: true,
        required: true,
      },
      lastName: {
        type: 'string',
        fieldName: 'lastName',
        returned: true,
        input: true,
        required: true,
      },
      role: {
        type: 'string',
        fieldName: 'role',
        returned: true,
        input: true,
        required: true,
      },
    },
  },
  account: {
    modelName: 'UserAccount',
  },
  session: {
    modelName: 'UserSession',
  },
  verification: {
    modelName: 'UserVerification',
  },
  databaseHooks: {
    user: {
      create: {
        before: async (user) => {
          console.log('ABOUT TO CREATE DB USER -> ', user);
          return { data: user };
        }
      }
    }
  },
  plugins: [
    genericOAuth({
      config: [
        {
          providerId: 'okta',
          clientId: process.env.OKTA_CLIENT_ID as string,
          clientSecret: process.env.OKTA_CLIENT_SECRET as string,
          discoveryUrl: new URL('/.well-known/openid-configuration', process.env.OKTA_ISSUER).href,
          scopes: ['openid', 'email', 'profile'],
          pkce: false,
        },
      ],
    }),
  ],
});

Additional context

No response

Originally created by @paambaati on GitHub (Jan 14, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/1210 ### Is this suited for github? - [X] Yes, this is suited for github ### To Reproduce 1. Follow documentation and set up the GenericOAuthPlugin like this – ```typescript plugins: [ genericOAuth({ config: [ { providerId: 'okta', clientId: process.env.OKTA_CLIENT_ID, clientSecret: process.env.OKTA_CLIENT_SECRET, discoveryUrl: new URL('/.well-known/openid-configuration', process.env.OKTA_ISSUER).href, scopes: ['openid', 'email', 'profile'], pkce: false, }, ], }), ] ``` 2. Login via the UI. ``` await signIn.oauth2({ providerId: 'okta', callbackURL: '/dashboard', }); ``` 4. Be presented with this error. <img width="481" alt="Screenshot 2025-01-14 at 10 30 40 PM" src="https://github.com/user-attachments/assets/6f1feb32-283c-433e-b2ac-e631f8be5495" /> ### Current vs. Expected behavior The expected behavior is login should work seamlessly. However, I get this error – ``` ERROR [Better Auth]: { error: 'invalid_request', error_description: 'PKCE code challenge should be specified in the authorize request for code verification.', status: 400, statusText: 'Bad Request' } ``` Here's what I see on the browser console – <img width="1770" alt="Screenshot 2025-01-14 at 10 40 21 PM" src="https://github.com/user-attachments/assets/21139020-7d39-4acd-8073-f2ae1196f198" /> ``` POST http://localhost:3000/api/auth/sign-in/oauth2 200 OK { "url": "https://abc.oktapreview.com/oauth2/v1/authorize?response_type=code&client_id=0oaj5irt3th0EhakA1d7&state=dMR147gkpAZcnsp2LFRPl7s-kj1Fhtpp&scope=openid+email+profile&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Foauth2%2Fcallback%2Fokta", "redirect": true } ``` ``` GET https://abc.oktapreview.com/oauth2/v1/authorize?response_type=code&client_id=0oaj5irt3th0EhakA1d7&state=dMR147gkpAZcnsp2LFRPl7s-kj1Fhtpp&scope=openid email profile&redirect_uri=http://localhost:3000/api/auth/oauth2/callback/okta 302 <html page with Error Code: oauth_code_verification_failed/> ``` ``` GET http://localhost:3000/api/auth/get-session 200 OK null ``` ``` GET http://localhost:3000/api/auth/oauth2/callback/okta?code=jJumX8_TBDNKWDuEnm7kOFTtdffi2J7Q6VRLmrKKb5Q&state=dMR147gkpAZcnsp2LFRPl7s-kj1Fhtpp 302 <html page with Error Code: oauth_code_verification_failed/> ``` ``` GET http://localhost:3000/api/auth/error?error=oauth_code_verification_failed 200 OK <html page with Error Code: oauth_code_verification_failed/> ``` ### What version of Better Auth are you using? 1.1.12 ### Provide environment information ```bash - OS: macOS Sequoia 15.2 - Browser: Mozilla Firefox 134.0 ``` ### Which area(s) are affected? (Select all that apply) Backend, Client ### Auth config (if applicable) ```typescript import { betterAuth } from 'better-auth'; import { prismaAdapter } from 'better-auth/adapters/prisma'; import { genericOAuth } from 'better-auth/plugins'; import { usePrisma } from '~/server/services/use-prisma'; const prisma = usePrisma(); export const auth = betterAuth({ database: prismaAdapter(prisma, { provider: 'postgresql', }), advanced: { // We'll let the default primary fields on PostgreSQL generate this themselves. generateId: false, }, user: { modelName: 'User', fields: { name: 'displayName', image: 'imageSrc', }, additionalFields: { firstName: { type: 'string', fieldName: 'firstName', returned: true, input: true, required: true, }, lastName: { type: 'string', fieldName: 'lastName', returned: true, input: true, required: true, }, role: { type: 'string', fieldName: 'role', returned: true, input: true, required: true, }, }, }, account: { modelName: 'UserAccount', }, session: { modelName: 'UserSession', }, verification: { modelName: 'UserVerification', }, databaseHooks: { user: { create: { before: async (user) => { console.log('ABOUT TO CREATE DB USER -> ', user); return { data: user }; } } } }, plugins: [ genericOAuth({ config: [ { providerId: 'okta', clientId: process.env.OKTA_CLIENT_ID as string, clientSecret: process.env.OKTA_CLIENT_SECRET as string, discoveryUrl: new URL('/.well-known/openid-configuration', process.env.OKTA_ISSUER).href, scopes: ['openid', 'email', 'profile'], pkce: false, }, ], }), ], }); ``` ### Additional context _No response_
GiteaMirror added the lockedbug labels 2026-04-13 03:47:31 -05:00
GiteaMirror commented 2026-04-13 03:47:33 -05:00
Author
Owner
Copy Link

@paambaati commented on GitHub (Jan 15, 2025):

Cross-posted here on the Better Auth Discord – https://discordapp.com/channels/1288403910284935179/1328964165657952287

<!-- gh-comment-id:2591705870 --> @paambaati commented on GitHub (Jan 15, 2025): Cross-posted here on the Better Auth Discord – https://discordapp.com/channels/1288403910284935179/1328964165657952287
GiteaMirror commented 2026-04-13 03:47:34 -05:00
Author
Owner
Copy Link

@paambaati commented on GitHub (Jan 15, 2025):

This seems to have been fixed in 6dc8422413, available in v1.1.14-beta.1.

Thanks @Bekacru for the quick fix!

<!-- gh-comment-id:2592717791 --> @paambaati commented on GitHub (Jan 15, 2025): This seems to have been fixed in https://github.com/better-auth/better-auth/commit/6dc8422413ea1685bce30f897928df6e1659c051, available in [`v1.1.14-beta.1`](https://github.com/better-auth/better-auth/commit/9b07a062957a2de92c2edea7ba53c1739e24179f). Thanks @Bekacru for the quick fix!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#8643
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?