Issue opened here
In this repo, I'm creating an auth flow that should (I think) work for Google OIDC. The deployed SST app works as expected, but the sst dev
behavior differs in unexpected ways.
Using SST CLI v0.0.419.
- Make sure your
aws
CLI is properly configured to allow creating AWS (Instructions here) - Create a Google OIDC Client ID (Instructions here)
- Make sure you have SST CLI installed globally (Instructions here)
- Run
sst install
- Create an SST Secret to store the OIDC Client ID created above
sst secret set GoogleOidcClientId <VALUE>
- Run
sst dev
, which should create all the AWS infra described insst.config.ts
- When the infra setup completes, the console should display a URL for the newly created
AuthRouter
. It should be something likehttps://<UNIQUE_ID>.cloudfront.net
. In our Google Cloud credentials dashboard, we need to add an authorized redirect URI using this url. The URI must be the URL followed by/google/callback
since that is what our auth handler (declared insrc/auth.ts
) expects, so for examplehttps://<UNIQUE_ID>.cloudfront.net/google/callback
. Note: It may take 5 minutes to a few hours for settings to take effect - Once the authorized redirect URI has been established, with
sst dev
running, we cancurl
our infra to test the auth flow, replacing the values in angled brackets with the corresponding values created above:curl -X GET https://<UNIQUE_ID>.cloudfront.net/google/authorize\?redirect_uri=https://<UNIQUE_ID>.cloudfront.net/google/callback\&response_type=code\&client_id=<GOOGLE_OIDC_CLIENT_ID>
Expected result: A 200 response, with a JSON body detailing a 302 redirect
Observed result: A 200 response, but no response body
The CloudWatch logs (see the sanitized logs in cloudwatch_logs.txt) show that when running sst dev
and hitting the endpoint, the auth handler Lambda function is receiving the correct message (the JSON body with the 302 info).
We can actually view the expected result if we sst deploy
instead of sst dev
:
- Close the
sst dev
process - Run
sst deploy
- Once deploy completes, run the same
curl
command as above.