i made a Discord bot which was working just fine until recently; since yesterday it's refusing to log in (output says invalid token was provided but creating a new token and putting it into code won't work).
The funny part is I actually have two versions of the same bot (deploy and test where the latter is only in one of my servers where i test new functions before implementing them in the deployed version).
Just replacing the token with the "test-bot" one fix the issue and allows me to correctly login (with the wrong bot of course since I'm using bot-test token).
To verify the token i made this very small script:
client.login(botToken).then().catch(reason => {
console.log("Login failed: " + reason);
console.log("Token used: " + botToken);
}); //login in discord
This allows me, in case of failed login to have similiar output:
Login failed: Error [TOKEN_INVALID]: An invalid token was provided.
Token used: NjAxMzc3Mzg3NDgwODc1MDE4.Xr5Cyg.xhX3QYqk0prPC7y3KS0yc5JA02U
Here you can see a screenshot from discord bot page where you can double-check the token used IS correct (the token now has been reset so this one won't be valid anymore)
I can tell the import method of the token (it's imported from another file) works fine (bot.js can see it and what i actually do when I change version is commenting/decommenting 2 lines of code (containing token and client ID which is used by a bot function).
Additional info:
I'm using Discord 12 at the moment but the bug started yesterday giving out the same result and I had installed discord 11+ back then.
nodejs version used is 12.16.3
npm version used is 6.14.4
bot is hosted in a VPS running Debian 9
Is anyone able to help with this or encountered similiar error?
Thanks in advance,
Related
Firebase ID token has invalid signature
Hi all, I'm somehow new to NodeJS and I've only used Google Firebase a few times.
Now, I'm trying to verify an idToken generated using getIdToken() method whenever a user signs up or signs in. The token generation works fine but if I try to use this token to authorize a user admin.auth().verifyIdToken(idToken) on another route, I get this error Firebase ID token has invalid signature on Postman. I tried to verify the token on jwt.io as well, it gave error Invalid Signature.
I tried switching to different algorithms, some eventually made the token valid on jwt, but there is usually a VERIFY SIGNATURE box by the bottom-right which I don't really know what to fill there. Well, I've tried copying different newly generated valid tokens by jwt after changing algorithm, but I still get Firebase ID token has invalid signature from Postman.
Does anyone know what the problem may be? Please help.
The problem comes from the Firebase Emulator Auth. The Firebase-hosted Auth is unable to verify JWT token generated by the Firebase Emulator Auth.
To verify the token manually on jwt.io, you need to grab one of the public keys from google: https://www.googleapis.com/robot/v1/metadata/x509/securetoken#system.gserviceaccount.com
To choose the correct key, find the one that corresponds to your kid from jwt.io.
Paste in the correct corresponding value and now your token should verify correctly (be sure to clear out any \n characters):
For easier programmatic verification, the "JWK URI" is https://www.googleapis.com/service_accounts/v1/jwk/securetoken#system.gserviceaccount.com
Source: https://firebase.google.com/docs/auth/admin/verify-id-tokens
For some reason, verifyIdToken function throws "Firebase ID token has invalid signature" each time for valid tokens when used in Firebase Emulator locally. I fixed this problem by starting using firebase hosted auth instead of emulator auth (remove auth property from firebase.json). Also, I reported the bug to Firebase.
I agree with Genius Hawlah's answer, the problem is the Firebase Emulator Auth. As a workaround I suggest to start emulators without the Auth one with the --only flag, for example firebase emulators:start --only firestore,functions, and authenticate with a user you have in the production Authentication
TLDR;
Prefer log from dart:developer over print and debugPrint.
I was not using the emulator...
I'm new to Firebase and have experienced this, and even upvoted GeniusHawlah's as Taras Mazurkevych's answers... But couldn't find anything in the Firebase setup related to the simulator that I did.
So it happened I was testing my firebase using a truncated JWT token, printed from Dart's debugPrint (which limits truncates output). I was successful in using log from dart:developer!
I was enlightened by https://github.com/flutter/flutter/issues/22665#issuecomment-456858672.
I encountered a similar problem, figured out that by BE was pointing to the local emulator, but FE was pointing to the remote Firebase Auth (because of a bug in the code firebase.auth().useEmulator(...) wasn't called)
As you can see in the source code, the firebase-admin package behaves differently when there is an Auth emulator available. You can either not start it to begin with or make it undiscoverable by removing its address from process.env.
delete process.env.FIREBASE_AUTH_EMULATOR_HOST
Source reference:
public verifyIdToken(idToken: string, checkRevoked = false): Promise<DecodedIdToken> {
const isEmulator = useEmulator();
return this.idTokenVerifier.verifyJWT(idToken, isEmulator)
.then((decodedIdToken: DecodedIdToken) => {
// Whether to check if the token was revoked.
if (checkRevoked || isEmulator) {
return this.verifyDecodedJWTNotRevokedOrDisabled(
decodedIdToken,
AuthClientErrorCode.ID_TOKEN_REVOKED);
}
return decodedIdToken;
});
}
emragins answer is great!
One thing which emragins wrote but it wasn't clear for me is that you need to copy the whole text between
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----\n
and made replace("\n","").
The result from this operation you can paste to the JTW.io. VERIFY SIGNATURE field.
I've cloned https://github.com/ananay/passport-apple-example and replaced the config with this:
clientID: "com.myname.web",
teamID: "myteamid",
callbackURL: "https://myurldev.com/auth/apple/redirect",
keyID: "mykeyid",
privateKeyLocation: path.join(__dirname, "../apple-key.p8")
I've also added SSL certificate on my machine and starting the server with https, all works fine & is recognized by my browser. I'm also starting the app on port 443 and proxying using my hosts file myurl.dev.com -> 127.0.0.1.
I have the same auth setup for facebook, google & microsoft and everything works fine.
I have:
Created a new APP identifier and enabled Sign in with Apple for it, named it: com.myname.dev
Created a new SERVICE identifier and enabled Sign in with apple, called it: com.myname.web
Added "https://myurldev.com/auth/apple/redirect" to the "Reply URLS" on the service identifier com.myname.web
Set my app identifier com.myname.dev as the main app identifier my service to be grouped with.
Created a private key and enabled sign in with apple, interface confirmed the presence of grouped ID com.myname.web bundled with com.myname.dev for which the key was created.
I have confirmed using console.log that the private key is indeed at the path being passed as parameter.
converted the .p8 file to base64 & then back to UTF-8 in an attempt to use the string for privateKeyString
successfully implemented Apple Oauth several times in the past using passport-apple
This time around, for some reason, auth simply doesn't work.
If I set the clientID as the APP identifier, not the service, I'm getting
invalid_request
Invalid web redirect url.
instead of invalid_client
Any advice on debugging this is highly appreciated. Thank you.
EDIT #1:
I have dug a bit deeper into the passport-apple package to figure out if anything goes against apple's docs around token generation, but the flow never reaches that part, indicating things go wrong on the actual configuration in Apple's console & what I'm trying to use for my project.
EDIT #2
2 of the app Ids I have created always throw "wrong redirect uri" because they're not service IDs so I can't configure redirect_uri, this will change if to "required" if I pass undefined as a redirect_uri.
One of the app ids throws only invalid client_id instead, regardless if I pass undefined or good value for redirect_uri.
EDIT #3
Went full vanilla through the OAuth code flow process and just created a url & redirected the user it, failing with this method is consistent with what is happening when using the passport-apple module.
const url = new URL("https://appleid.apple.com/auth/authorize");
url.searchParams.append("state", "fdbd287b1f");
url.searchParams.append("response_type", "code");
url.searchParams.append("scope", "name email");
url.searchParams.append("response_mode", "form_post");
url.searchParams.append(
"redirect_uri",
"https://raiseitupdev.com/auth/apple/redirect",
);
url.searchParams.append("client_id", "com.myname.web");
return res.redirect(url.toString());
[Creator of the library here.]
Did it stop working in development too? I feel this is a configuration error because the actual thing is working live on my website:
https://passport-apple.ananay.dev
Please follow up on this Github issue. Thanks!
https://github.com/ananay/passport-apple/issues/23
I have two separate Google App Engine projects (let's call them projects A and B) that I'm using Oauth2 to validate users for. For each project, I generated its own Oauth 2.0 Client ID.
So for project B, attempting to verify my Oauth2 token yields a value error. From what I can tell, for some reason it's expecting the ClientID from project A. Using project A's Client ID actually makes everything work as expected, which seems weird.
I'm using Python3.5 for this project and trying to use to deploy a webpage using Flask, if that helps anything.
Error Code: (keys redacted)
Token has wrong audience <Client ID A>, expected <Client ID B>
Code for verifying token:
from google.oauth2 import id_token
from google.auth.transport import requests as goog_requests
from flask import Flask, render_template, request
...
# Verify and get info for the user's ID token.
# This is where the error gets thrown
idinfo = id_token.verify_oauth2_token(
request.headers.get('X-id-token'),
goog_requests.Request(),
CLIENT_ID
)
Additional info - as I'd expect with that error code, the UI for loging in indicates that I'm trying to login to project A as well. I'm also wondering if this has anything to do with my google sdk cli configuration. I tried resetting my default project to project B but that didn't change anything.
Any help is greatly appreciated!
I'm dumb. I didn't change the sign-in object(?) in my HTML to match the new Client ID. I had to change
<meta name="google-signin-client-id" content="CLIENT_ID">
to the new client ID.
i am using lavel/socialite in laravel project version 5.4
Now i am facing an error
ClientException
Client error: `POST https://graph.facebook.com/v3.0/oauth/access_token`
resulted in a `400 Bad Request` response:{"error":{"message":"This
authorization code has been used.","type":"OAuthException", "code":100,
"fbtrace_id":"F7xwAj18Ez (truncated...)
some times it working and sometimes showing this error.
have any suggestions to solve the issue.
in some cases, you can use a simple condition
if (!$request->has('code') || $request->has('denied')) {
return redirect('/');
}
because when you try more than once facebook will not allow for gave information request.
I'm using the Admin SDK, Auth feature.
When calling admin.auth().verifyIdToken(token) and the token is expired I get the error
Firebase ID token has expired. Get a fresh token from your client app and try again. See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve an ID token.
With error code
auth/argument-error
First of all, should the error code not be "auth/user-token-expired"?
Second, the error code I received is not in the Admin Authentication API Errors
I have a hard time handling all firebase errors properly so I can reply with proper error messages to the consumers of my API.
Expired tokens and invalid signatures are reported with the AuthClientErrorCode.INVALID_ARGUMENT error code. It seems the value of this constant is defined as argument-error in source. This can be fixed in a future release (or alternatively update the documentation to reflect the correct value of the constant, and avoid a potentially breaking change).
There is no such error code as auth/user-token-expired in Admin SDK. Suggest you report a feature request in the Github repo if that is important to you.