Parameter not allowed for this message type: code_challenge_method, how to fix it in nuxt?

Question

in Nuxt I have the title error using auth v5. This is my current strategy:

The docs (https://dev.auth.nuxtjs.org/schemes/oauth2#codechallengemethod) says that you can use "plain" or "S256" as an option, I tried both but the error persists.

The only I cant manually get it work is by copy-pasting the oAuth in the url:

https://accounts.google.com/o/oauth2/auth/identifier?protocol=oauth2&response_type=token&client_id=MYCLIENTID&redirect_uri=https%3A%2F%2Flocalhost%3A3005%2Flogin&scope=profile%20email&state=sIpW-W_6h_QwUs0gCDV_o&flowName=GeneralOAuthFlow

Compare that link to the following:

https://accounts.google.com/o/oauth2/auth/identifier?protocol=oauth2&response_type=token&client_id=MYCLIENTID&redirect_uri=https%3A%2F%2Flocalhost%3A3005%2Flogin&scope=profile%20email&state=sIpW-W_6h_QwUs0gCDV_o&code_challenge_method=S256&code_challenge=fnyp2Ray850HEmHEwmoyQtIrPFPpHWBt4nVAz9p5Vxs&flowName=GeneralOAuthFlow

The only difference between the first and second link is that the first one actually works (I can login) and it doesn't have a challenge_method.

The second link doesn't work (it displays the google image above) but if you read the end of the link it has both the code_challenge_method & code_challenge

Answer 1

After many hours of trial and error, the only way to make it work is by setting code_challenge_method to an empty string, like this:

The demo used in the nuxt auth module, does the same thing, they don't use any code_challenge_method with the google strategy

EDIT 10/06/2021

After doing further investigation, it seems that if I only use an empty code_challenge_method (just like the image above), google auth just doesn't seem to work anymore, my bet is that a broken commit was merged here, so in order to fix it I added a new property to my google strategy:

responseType: 'token id_token'

I also created a report for that bug here

Answer 2

I had the same error and this setup has fixed my issues. Note I am using Next-auth but the parameter name is the same except for the naming convention. Set response_type value to code. Setting the response_type value to token will issue an error, so use code instead.