diff --git a/.env.example b/.env.example index 980792eb6..dcf3dcb58 100644 --- a/.env.example +++ b/.env.example @@ -23,6 +23,10 @@ NEXT_PRIVATE_OIDC_CLIENT_ID="" NEXT_PRIVATE_OIDC_CLIENT_SECRET="" NEXT_PRIVATE_OIDC_PROVIDER_LABEL="OIDC" NEXT_PRIVATE_OIDC_SKIP_VERIFY="" +# Specifies the prompt to use for OIDC signin, explicitly setting +# an empty string will omit the prompt parameter. +# See: https://www.cerberauth.com/blog/openid-connect-oauth2-prompts/ +NEXT_PRIVATE_OIDC_PROMPT="login" # [[URLS]] NEXT_PUBLIC_WEBAPP_URL="http://localhost:3000" diff --git a/packages/auth/server/lib/utils/handle-oauth-authorize-url.ts b/packages/auth/server/lib/utils/handle-oauth-authorize-url.ts index d0fa72d1d..f62d27fa9 100644 --- a/packages/auth/server/lib/utils/handle-oauth-authorize-url.ts +++ b/packages/auth/server/lib/utils/handle-oauth-authorize-url.ts @@ -27,13 +27,13 @@ type HandleOAuthAuthorizeUrlOptions = { /** * Optional prompt to pass to the authorization endpoint. */ - prompt?: 'login' | 'consent' | 'select_account'; + prompt?: 'none' | 'login' | 'consent' | 'select_account'; }; const oauthCookieMaxAge = 60 * 10; // 10 minutes. export const handleOAuthAuthorizeUrl = async (options: HandleOAuthAuthorizeUrlOptions) => { - const { c, clientOptions, redirectPath, prompt = 'login' } = options; + const { c, clientOptions, redirectPath } = options; if (!clientOptions.clientId || !clientOptions.clientSecret) { throw new AppError(AppErrorCode.NOT_SETUP); @@ -63,7 +63,11 @@ export const handleOAuthAuthorizeUrl = async (options: HandleOAuthAuthorizeUrlOp ); // Pass the prompt to the authorization endpoint. - url.searchParams.append('prompt', prompt); + if (process.env.NEXT_PRIVATE_OIDC_PROMPT !== '') { + const prompt = process.env.NEXT_PRIVATE_OIDC_PROMPT ?? 'login'; + + url.searchParams.append('prompt', prompt); + } setCookie(c, `${clientOptions.id}_oauth_state`, state, { ...sessionCookieOptions, diff --git a/turbo.json b/turbo.json index d2217d211..a60f12b6b 100644 --- a/turbo.json +++ b/turbo.json @@ -119,6 +119,7 @@ "GOOGLE_APPLICATION_CREDENTIALS", "E2E_TEST_AUTHENTICATE_USERNAME", "E2E_TEST_AUTHENTICATE_USER_EMAIL", - "E2E_TEST_AUTHENTICATE_USER_PASSWORD" + "E2E_TEST_AUTHENTICATE_USER_PASSWORD", + "NEXT_PRIVATE_OIDC_PROMPT" ] }