"InvalidCheck: PKCE code_verifier cookie was missing" error only in production

[SamGenieDev]

Since using Auth.js in production, some users have been experiencing this error preventing them from signing in with google.

[auth][error] InvalidCheck: PKCE code_verifier cookie was missing.. Read more at https://errors.authjs.dev#invalidcheck

I'm using Sveltekit with node-adapter hosted behind an nginx reverse proxy. I haven't been able to reliably reproduce this issue, but I know that lots of users randomly experience it and it usually goes away after a few attempts logging in.

Auth.js config

export const { handle: handleAuth } = SvelteKitAuth({
	trustHost: true,
	providers: [Google({
		authorization: "https://accounts.google.com/o/oauth2/auth/authorize?response_type=code&prompt=login", // Allows user to select a Google account
	})],
	pages: {
		error: "/error/auth" // Custom error page
	},
	callbacks: {
		signIn: async ({ user, account }) => {
			...
		},
		jwt: ({ token, account, user }) => {
			...
		},
		session: async ({ session, token }) => {
			...
		}
	}
});

I have tried adding this to that config but it didn't change anything:

	cookies: {
		pkceCodeVerifier: {
			name: "authjs.pkce.code_verifier",
			options: {
				httpOnly: true,
				sameSite: "none",
				path: "/",
				secure: true
			}
		}
	},

Tried adding checks: ["none"] to the Google provider config. Also tried checks: ["state"]. Either gives the error:

error {
  error: 'invalid_grant',
  error_description: 'code_verifier or verifier is not needed.'
}
CallbackRouteError: Read more at https://errors.authjs.dev#callbackrouteerror
type: 'CallbackRouteError',
  kind: 'error',
  [cause]: {
    err: Error: TODO: Handle OIDC response body error

Environment variables:

AUTH_GOOGLE_ID=...
AUTH_GOOGLE_SECRET=...
AUTH_SECRET=...

nginx configuration:

...
server {
	listen 443 ssl;

	...

	location / {
		proxy_pass http://localhost:8080;

		# Forward headers
		proxy_set_header Host $host;
		proxy_set_header Origin $scheme://$host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Forwarded-Host $host;

		# WebSocket support
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";
	}
}
...

I am wondering if it's caused by the front-facing server being HTTPS and the internal server being HTTP. Maybe this causes problems with secure cookies? I'm not sure but it's working for most users so this is unlikely.

Does anyone have any ideas? Greatly appreciate any help with this.

[k-taro56]

Just to confirm, does the signIn callback function always return true?

[SamGenieDev]

No, it can return false for users that are banned. Gives AccessDenied error which is expected.

[k-taro56]

#9990