Apple OAuth login fails: "response_mode must be form_post when name or email scope is requested"

[yurvon-screamo]

Sign in with Apple is broken: any OAuth login attempt through the Apple provider
redirects to appleid.apple.com/auth/authorize and immediately fails with:

invalid_request
response_mode must be form_post when name or email scope is requested.

For Apple trailbase always request the name and email scopes, but the
authorization URL is built without response_mode=form_post (Apple requires form_post whenever any scope is requested).
On top of that, the OAuth callback only accepts GET requests, so form_post alone would not be enough - the
callback needs to accept the POST form redirect from Apple too.

Environment

• Docker image trailbase/trailbase:0.33.1
• Apple provider type: Services ID (client_id), client secret (JWT)
• Auth flow from the client: /api/auth/v1/oauth/apple/login?redirect_uri=...&response_type=code&pkce_code_challenge=... (authorization code + PKCE)

[ignatz]

@yurvon-screamo thanks for raising the issue. There were a few OAuth changes between v0.33.0 and v0.33.2, so scoping it down to pre v0.33.1 is super useful. Let me have a look and sorry for the invoncenience

[ignatz]

Staring at the code for a little bit, I wonder if this ever worked :/. Did it ever work for you? I can try to fix it, sadly I don't have the setup with apple to test it myself. Would you be so kind to build and try a fix? 🙏

[yurvon-screamo]

Thanks for the quick fix in v0.33.6!

We tested it against a live deployment (real Apple ID, Services ID + .p8 secret, HTTPS). Results:

What works:

• The authorize request is accepted by Apple (no more invalid_request) and Apple POSTs the form callback - response_mode=form_post + the POST callback handler both work, the state cookie arrives and validates.

What still fails:

• login dies with 424 Failed Dependency after a successful code exchange

I`m trying to fix it now

[ignatz]

Thanks for bearing with me 🙏 . Also happy to write a quick fix. Whatever works best for you, don't want to clobber your work

[ignatz]

Btw according to https://developer.apple.com/forums/thread/746352, implementations should be able to handle both: strings and booleans

[ignatz]

I did the decoder changes slightly differently but pulled in your content-type changes and tests in 52f5f4d 🙏

[yurvon-screamo]

I did the decoder changes slightly differently but pulled in your content-type changes and tests in 52f5f4d 🙏

check my PR - #284 - you cat transfer all changes to your implementation. I tested my impl on my product, you can try too, its work.

• https://app.origa.uwuwu.net/
• https://github.com/yurvon-screamo/origa/blob/7fcaa3b8f5974e3cd560ae44cffb965054629540/origa_ui/Dockerfile#L118