Setting redirect when accessing Cognito via sk-auth

Question

I have built a Svelte application using SvelteKit that uses Cognito for authentication. I used the following site: Cognito authentication for your SvelteKit app guide me in setting this up. The app and connection to Cognito works well when running in local development via npm run dev, however, when running in production on an EC2 server via npm run build and pm2 start /build/index.js it sets the redirect_uri portion of the Cognito URI to http://localhost:3000. I can't figure out how to get it to set the redirect to my actual domain.

Here are some relevant code snippets on how it is currently set up on EC2:

/etc/nginx/sites-available/domain.conf

server {

  server_name example.com;

  location / {
    root /var/www/html/build;
    proxy_pass http://localhost:3000;
  }

  listen [::]:443 ssl ipv6only=on;
  listen 443 ssl;
  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  include /etc/letsencrypt/options-ssl-nginx.conf;
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

}

svelte.config.js

import node from '@sveltejs/adapter-node';

/** @type {import('@sveltejs/kit').Config} */
const config = {
  kit: {
    target: '#svelte',
    adapter: node({
      out: 'build',
      precompress: false,
      env: {
        host: 'example.com',
        port: '443'
      }
    })
  }
};

export default config;

/src/lib/auth.js

import { SvelteKitAuth, Providers } from 'sk-auth';

const DOMAIN = 'myapi.auth.us-east-1.amazoncognito.com';

const config = {
  accessTokenUrl: `https://${DOMAIN}/oauth2/token`,
  profileUrl: `https://${DOMAIN}/oauth2/userInfo`,
  authorizationUrl: `https://${DOMAIN}/oauth2/authorize`,
  redirect: 'https://example.com',
  clientId: myAWSclientID,
  clientSecret: myAWSclientSecret,
  scope: ['openid', 'email'],
  id: 'cognito',
  contentType: 'application/x-www-form-urlencoded'
};

const oauthProvider = new Providers.OAuth2Provider(config);

export const appAuth = new SvelteKitAuth({
  providers: [oauthProvider]
});

Expected URL when going to Cognito

https://myapi.auth.us-east-1.amazoncognito.com/login?state=cmVkaXJlY3Q9Lw%3D%3D&nonce=699&response_type=code&client_id=myAWSclientID&scope=openid+email&redirect_uri=https%3A%2F%2Fexample.com%2Fapi%2Fauth%2Fcallback%2Fcognito%2F

Actual URL when going to Cognito

https://myapi.auth.us-east-1.amazoncognito.com/login?state=cmVkaXJlY3Q9Lw%3D%3D&nonce=699&response_type=code&client_id=myAWSclientID&scope=openid+email&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fcognito%2F

As you can see, it is attempting to set the redirect_uri to http://localhost:3000 instead of the expected https://example.com. I'm pretty sure that there is some setting somewhere to allow it to set the correct redirect_uri when going to Cognito - any ideas or suggestions would be appreciated!

Answer 1

From what I can tell looking at the sk-auth module source code, redirect_uri doesn't appear to be a valid config option. Try setting the host config option in the global SkAuth constructor instead:

const config = {
  accessTokenUrl: `https://${DOMAIN}/oauth2/token`,
  profileUrl: `https://${DOMAIN}/oauth2/userInfo`,
  authorizationUrl: `https://${DOMAIN}/oauth2/authorize`,
  // redirect_uri: 'https://example.com',
  clientId: myAWSclientID,
  clientSecret: myAWSclientSecret,
  scope: ['openid', 'email'],
  id: 'cognito',
  contentType: 'application/x-www-form-urlencoded'
};
.
.
export const appAuth = new SvelteKitAuth({
  providers: [oauthProvider],
  host: 'https://example.com',
});

After further browsing the source, you can also set the redirect option provided by the AuthCallbacks interface on the provider configuration:

const config = {
  accessTokenUrl: `https://${DOMAIN}/oauth2/token`,
  profileUrl: `https://${DOMAIN}/oauth2/userInfo`,
  authorizationUrl: `https://${DOMAIN}/oauth2/authorize`,
  // redirect_uri: 'https://example.com',
  redirect: 'https://example.com',
  clientId: myAWSclientID,
  clientSecret: myAWSclientSecret,
  scope: ['openid', 'email'],
  id: 'cognito',
  contentType: 'application/x-www-form-urlencoded'
};

which, incidentally, is what the author uses in the tutorial you referred to.