fix: use custom profile/email scopes and userinfo endpoint under strict mode - #17
Draft
adamflitney wants to merge 2 commits into
Draft
fix: use custom profile/email scopes and userinfo endpoint under strict mode#17adamflitney wants to merge 2 commits into
adamflitney wants to merge 2 commits into
Conversation
…ct mode Auth0's strict third-party security mode drops openid/profile/email and disables the native /userinfo endpoint for third-party clients, so this example silently lost profile/email data. Switches to Yoto's own user:profile:view/user:email:view scopes and custom /userinfo endpoint, sets authorizationUrl/tokenUrl explicitly instead of discoveryUrl (which would otherwise overwrite the userInfoUrl override), and enables PKCE (required unconditionally under strict mode, even for confidential clients). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auth0's strict third-party security mode drops
openid/profile/emailand disables the native/userinfoendpoint for third-party clients, so this example was silently losing profile/email data (and would in fact load an error page when you tried to log into a strict mode client). Switches to Yoto'suser:profile:view/user:email:viewscopes and custom/userinfoendpoint, setsauthorizationUrl/tokenUrlexplicitly instead ofdiscoveryUrl, and enables PKCE (both needed for strict mode clients)Validated end-to-end against a real strict-mode third-party client in test env: confirmed the original config fails with
user_info_is_missing, and this fix resolves the session correctly. Depends on (the new scopes) being deployed.