Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AuthException from auth.getSessionFromUrl() does not contain error code. #964

Closed
superakabo opened this issue Jul 3, 2024 · 0 comments · Fixed by #968
Closed

AuthException from auth.getSessionFromUrl() does not contain error code. #964

superakabo opened this issue Jul 3, 2024 · 0 comments · Fixed by #968
Labels
bug Something isn't working

Comments

@superakabo
Copy link

superakabo commented Jul 3, 2024

Describe the bug
When a password reset link or similar link expires an AuthException(message: Email link is invalid or has expired, statusCode: null) is thrown. The AuthException should have a non-null statusCode because the processed auth url contains an error code (error_code=403) as part of its query parameters.

To Reproduce
Steps to reproduce the behavior:

  1. Request a password reset link via email using the Supabase Flutter SDK by executing
 Supabase.instance.client.auth.resetPasswordForEmail(
          '[email protected]',
          redirectTo: 'https://my_deep_link.com/password-reset',
     );
  1. Tap on the "Reset Password" link twice from your email.
  2. Check your IDE console logs to see the error.

Alternatively, if you have an existing expired processed auth url, you can execute

 AuthSessionUrlResponse response = await Supabase.instance.client.auth.getSessionFromUrl(
                        Uri.parse(
                            'https://example.com/reset-password?error=access_denied&error_code=403&error_description=Email+link+is+invalid+or+has+expired#error=access_denied&error_code=403&error_description=Email+link+is+invalid+or+has+expired'),
                        storeSession: false,
               );

Expected behavior
The AuthException thrown should be

AuthException(message: "Email link is invalid or has expired", statusCode: "403");

Version (please complete the following information):
Dart SDK 3.4.0
Flutter SDK 3.22.0
myapp 1.0.0+1

├── supabase_flutter 2.5.6
│ ├── supabase 2.2.2
│ │ ├── functions_client 2.2.0
│ │ ├── gotrue 2.8.1
│ │ ├── postgrest 2.1.2
│ │ ├── realtime_client 2.1.0
│ │ ├── storage_client 2.0.2

Additional context
From the source code (src/supabase_auth.dart),
it seems an omission was made around line 760:
"GoTrueClient.getSessionFromUrl (package:gotrue/src/gotrue_client.dart:760:7)"

final errorDescription = url.queryParameters['error_description'];
    if (errorDescription != null) {
      throw AuthException(errorDescription);
    }

it could be

    final errorCode = url.queryParameters['error_code'];
    final errorDescription = url.queryParameters['error_description'];
    if (errorDescription != null) {
      throw AuthException(errorDescription, statusCode: errorCode);
    }

Making this change is non-breaking.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant