fix(smartling): use oauthCallback to fix broken OAuth authentication [AIS-82] - #11049
Merged
Merged
Conversation
…nSet Smartling's SSO returns only access_token and refresh_token — no id_token. client.callback() calls validateIdToken() after the code exchange and throws "id_token not present in TokenSet" when id_token is absent. client.oauthCallback() performs the same authorization_code grant but skips id_token validation entirely, which is correct here since the app only ever uses access_token and refresh_token. Confirmed broken in prod via CloudWatch: sls-apps-smartling-prd-app logging "Smartling OAuth failed with message: id_token not present in TokenSet" on every auth attempt. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension. |
ethan ozelius (ethan-ozelius-contentful)
approved these changes
Jul 1, 2026
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Jared Jolton (jjolton-contentful)
approved these changes
Jul 1, 2026
Tyler (tylerwashington888)
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
client.callback()withclient.oauthCallback()in the Smartling Lambda OAuth handlerid_token not present in TokenSet, getting bounced to the error redirect, and seeing the App SDK "outside of Contentful" console errorRoot cause
openid-client'scallback()method callsvalidateIdToken()after the authorization code exchange and throwsid_token not present in TokenSetwhen the token response doesn't include anid_token. Smartling's SSO (sso.smartling.com/auth/realms/Smartling) returns onlyaccess_tokenandrefresh_token— a pure OAuth 2.0 response.oauthCallback()performs the identicalauthorization_codegrant but skipsid_tokenvalidation entirely, which is correct since the app only ever usesaccess_tokenandrefresh_token.Test plan
access_tokenandrefresh_tokenare returned and the popup closes successfullySmartling OAuth failederrors in CloudWatch after deploy to prod