Hi guys I m using supertokens to authenticate a Google Sheet

Question

Hi guys I m using supertokens to authenticate a Google Sheets Add On using Google as Third Party Provider I am unable to get through a CORS Issue which wasn t there before in the application Only the sign in api is failing with CORS error Any help on this

nkshah2 · Answer

Hi < ggishant>

nkshah2 · Answer

Can you share the error you get in the browser

rp · Answer

Check this out https supertokens com docs thirdpartyemailpassword troubleshooting cors issues

rp · Answer

Maybe it has the CORS issue you are facing If not then please let us know what the browser console says

ggishant · Answer

This is the error in browswer

nkshah2 · Answer

The browser console should also print out an error for this

nkshah2 · Answer

Or you can hover the warning symbol

nkshah2 · Answer

Right can I see the value of `appInfo` in your backend when you call SuperTokens init

ggishant · Answer

I think this is the correct error

nkshah2 · Answer

I think you have set the origin to ` ` when using the `CORS` middleware

nkshah2 · Answer

It should be set to the domain of your website `http localhost 3000` in this case

ggishant · Answer

I don t think we ll be able to use cookies as our auth method Google set a different domain in Origin and Referer everytime it make a rqeuest or if I just include googleusercontent com will it work

nkshah2 · Answer

`https googleusercontent com` this should work

nkshah2 · Answer

But when testing with a website running locally this will still give errors so you may want to allow `http localhost 3000` during development

ggishant · Answer

Yes definitely

ggishant · Answer

I ll try this out

ggishant · Answer

I m getting this issue now

ggishant · Answer

my dev nginx config

nkshah2 · Answer

You can use the CORS middleware to do this in a much simpler way refer to the docs here https supertokens com docs session quick setup backend 3 add the supertokens apis cors setup

ggishant · Answer

Thanks now I m getting this error

nkshah2 · Answer

Can I see the value of the Set Cookie header

ggishant · Answer

Sure

ggishant · Answer

`sRefreshToken=duXb2IiEGCtVful4uW3M8Ho30Z8r9QypsABKk6E9oDAWl5Vk9lkC 2FXfRh85a 2FFu 2B7SFBCYOEfo7ay4JUaRAl4B4weGJJpXVeiQCU2VGfi 2FOE92wZ 2FFNxmeYKziu2ARu5vbBjvsmG5iuNrvcBU4s2EkKvifSDN 2FqTQSVjDvH6kJi5xgcztaAvu3nLa 2FKfDr38w4cZlNP2fVs6iDBjhXuG2tiEba5fZZs 2B 2BeepzW4jOPOFiPltyS48IB 2B4TFWoLp 2FrOPxTck8g ca05826bdfeab9219e9fe79b23f0d6a2cb44511fc8b2f3715ed118ec32d1a64d V2 Path= auth session refresh Expires=Sun 15 Jan 2023 10 46 37 GMT HttpOnly Secure SameSite=Lax`

nkshah2 · Answer

There should be more than one cookie in it

ggishant · Answer

`Set Cookie sRefreshToken=duXb2IiEGCtVful4uW3M8Ho30Z8r9QypsABKk6E9oDAWl5Vk9lkC 2FXfRh85a 2FFu 2B7SFBCYOEfo7ay4JUaRAl4B4weGJJpXVeiQCU2VGfi 2FOE92wZ 2FFNxmeYKziu2ARu5vbBjvsmG5iuNrvcBU4s2EkKvifSDN 2FqTQSVjDvH6kJi5xgcztaAvu3nLa 2FKfDr38w4cZlNP2fVs6iDBjhXuG2tiEba5fZZs 2B 2BeepzW4jOPOFiPltyS48IB 2B4TFWoLp 2FrOPxTck8g ca05826bdfeab9219e9fe79b23f0d6a2cb44511fc8b2f3715ed118ec32d1a64d V2 Path= auth session refresh Expires=Sun 15 Jan 2023 10 46 37 GMT HttpOnly Secure SameSite=Lax Set Cookie sIdRefreshToken=7247a316 cd00 4155 9a1c b0a674528f5f Path= Expires=Sun 15 Jan 2023 10 46 37 GMT HttpOnly Secure SameSite=Lax Set Cookie sAccessToken=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsInZlcnNpb24iOiIyIn0 3D eyJzZXNzaW9uSGFuZGxlIjoiODRiY2MyZDUtNjA1YS00YzU4LWJiZGYtZmYzNjBiNTAxY2VjIiwidXNlcklkIjoiMkZuUTRFM2g4VFpNVE9pT1hFb25hdDlFZVNSIiwicmVmcmVzaFRva2VuSGFzaDEiOiJlNDBhMGJhYTE1NTYzOWRmNGVjNmMzZDZhOGMzMTY4OWVmYzJhODM3MmUzM2FmZDVhY2Y5YWM0OTVkYWE3MzkyIiwicGFyZW50UmVmcmVzaFRva2VuSGFzaDEiOm51bGwsInVzZXJEYXRhIjp7fSwiYW50aUNzcmZUb2tlbiI6bnVsbCwiZXhwaXJ5VGltZSI6MTY2NTE0MzE5NzM0NSwidGltZUNyZWF0ZWQiOjE2NjUxMzk1OTczNDUsImxtcnQiOjE2NjUxMzk1OTczNDR9 FOoWTUPnG64k7mw2 2Bai8Z0yT9v3t9HJ3lnqhyQ0sv 2F1uokN1FxtWhprh 2BF 2F98Vr9nn4lcYqLqCxloVPH6PB4m6kYtB32txcYpMoU5m 2FuiykS0ckDB7CoHceNn25aUcXARvJh2PanAShGbG4GrLbkPk 2BY 2FmTqNLLJajpK4QnhH0CtyG1uBD0sJGfYMMfX 2FFesnTv 2B79c1jYg0tPmhYmRuzO40XDS9sLzQSjrBX4EXDaPlrlz6zyzdF87FfZHuG47jfetrBduQctDzvgSR3rvf68UbsVXdjOnf4h9gB5 2B9aZb32JLrmo0fqeJRsQhoWX4QYF6gFm7svnClT4Z2583KMA 3D 3D Path= Expires=Fri 07 Oct 2022 11 46 37 GMT HttpOnly Secure SameSite=Lax`

nkshah2 · Answer

What are the values for the api and website domain

ggishant · Answer

api is ishant app amigotest org website is amigotest org

nkshah2 · Answer

In the screenshot it seems that the same environment variable is used for both

ggishant · Answer

oh yes but is that the cause of this issue

nkshah2 · Answer

So the website domain needs to match the URL you are making requests from in this case you would want it to be `localhost 3000`

ggishant · Answer

but i want to authenticate requests from different domains as well for instance when I m using the google sheets add on

ggishant · Answer

`Set Cookie workspace id=2FnQ4E3h8TZMTOiOXEonat9EeSR Path= Expires=Sat 07 Oct 2023 10 57 04 GMT HttpOnly Secure SameSite=None`

ggishant · Answer

I m able to set this cookie successfully anyway I can disable the SameSite attribute of the cookies provided by the supertoken core

nkshah2 · Answer

Try this https supertokens com docs session common customizations sessions share sessions across sub domains

ggishant · Answer

is it possible if we could get on a brief call

nkshah2 · Answer

Sure ill send you a link

ggishant · Answer

great

nkshah2 · Answer

https meet google com cyg mtyp bvv

ggishant · Answer

So now I have two tokens on the frontend Front Token and Id Refresh Token is front token the token for bearer auth

nkshah2 · Answer

Front Token is the equivalent of access token if you enable JWTs with the session recipe the front token will contain the JWT Since you are doing the frontend parts of it manually you would need to do something along the lines of `Base64Decode FrontToken up jwt`

nkshah2 · Answer

The `jwt` is what you would use for Bearer tokens

ggishant · Answer

oh cool

ggishant · Answer

What parameters are required for apple sign in

nkshah2 · Answer

After signing in with apple you can get the authorization code from the result and use that to call the signinup API

nkshah2 · Answer

The full spec is here https supertokens com docs fdi ThirdParty 20Recipe signInUp

nkshah2 · Answer

You dont need `code`

ggishant · Answer

On what key

nkshah2 · Answer

`authCodeResponse`

ggishant · Answer

I m not getting `accessToken` from apple login

nkshah2 · Answer

Can you share the value of the auth code

nkshah2 · Answer

Also try sending the access token as an empty string

nkshah2 · Answer

and just send the id token

ggishant · Answer

I have authorizationCode and identityToken

ggishant · Answer

okay will try empty string

nkshah2 · Answer

Ah right in that case you want the request body to look like ``` redirectURI thirdPartyId apple code authorizationCode ```

ggishant · Answer

This doesn t work

ggishant · Answer

Trying something else will let you know

nkshah2 · Answer

What error did you get

ggishant · Answer

err the client for whom this key is for is different than the one provided

ggishant · Answer

Also I m unable to find the exact client id on apple dev console

nkshah2 · Answer

Did you generate a service id on the apple dashboard

nkshah2 · Answer

https supertokens com docs thirdparty quick setup backend 3 initialise social login providers The docs have a link to an article to follow for Apple maybe that helps

ggishant · Answer

Yes generated a service id on dashboard Does supertoken only support the web flow for apple authorisation

nkshah2 · Answer

No it supports the auth code flow as well

nkshah2 · Answer

The service id is the client Id

ggishant · Answer

I m getting a 404 when user redirects from the flow to my api webpage for apple with code in query param How do I specify the redirect url while initialising the provider

nkshah2 · Answer

You should be able to pass AuthorisationRedirect when initialising apple which lets you specific params

nkshah2 · Answer

To clarify this is when you initialise the apple provider as part of initialising SuperTokens in your backend

ggishant · Answer

Is params a type from the supertokens library

nkshah2 · Answer

https github com supertokens supertokens golang blob master recipe thirdparty tpmodels providers go