Experiencing "Invalid verifier" error with Google OAuth in Convex Auth
Experiencing "Invalid verifier" error with Google OAuth in Convex Auth
I'm facing an issue where the user session doesn’t persist after a page refresh when using Google OAuth with Convex Auth. The authSessions table remains empty, and I’m seeing an "Invalid verifier" error in the Convex logs. Here’s my Convex backend configuration:
Environment Details
- @convex-dev/auth: ^0.0.84
- convex: ^1.24.0
- Platform: Web (Next.js with App Router)
Convex Backend Configuration (convex/auth.ts)
Environment variables (GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET) are set in the Convex dashboard.
Middleware (middleware.ts)
Error Logs (Convex Dashboard)
Is there a solution that works?
36 Replies
@erquhart Can you please take a look at this?
@erquhart Someone also opened an issue on GitHub regarding this 3 weeks ago: https://github.com/get-convex/convex-auth/issues/193
GitHub
Fix Google OAuth session persistence after page refresh · Issue #1...
Description Issue When logging in via Google authentication, the user session doesn't persist after refreshing the browser page. Convex logs show the error message "Invalid verification co...
@erquhart ?
What is your callback url?
Can you enable debug logs in your client and Convex functions and share (redact if/as needed) - instructions here: https://labs.convex.dev/auth/debugging#enabling-verbose-logging
@erquhart Here are the logs (redacted) after enabling verbose logging.
@erquhart Provided the logs on GitHub also: https://github.com/get-convex/convex-auth/issues/193#issuecomment-2886888325
GitHub
Fix Google OAuth session persistence after page refresh · Issue #1...
Description Issue When logging in via Google authentication, the user session doesn't persist after refreshing the browser page. Convex logs show the error message "Invalid verification co...
These logs look like you ran convex dev and then hit google log in, when did the refresh occur? Trying to understand where it says the user doesn't exist
Here's what I do:
- I click on Sign in with Google.
- A window opens where I have to select the account which I wanna use to sign in.
- I select and then I get redirected to the "/" route of my app.
In the video you can clearly see that indeed a user is created.
The problem is that when I am redirected to the "/" route, I am not in an authenticated state.
According to my understanding, the session doesn't remain. In the code you can see I have set the "cookie config", I thought maybe I haven't configured the "Cookie age" maybe that's the problem.
But after configuring that also, the behavior still remains the same.
The logs contain "No existing users found, creating new user" because at that point my users table was empty.
@erquhart In the GitHub issue the person who created the issue also faces the same experience, the session is not persistent.
I think since Convex Auth is in beta, this is a bug/issue in the Convex Auth itself.
The troubling part is:
While I am being redirected back to my "/" route, something happens that causes the session to end, that's why by the time I am at "/" route I am in an unauthenticated state.
So errors are there, I have provided what kind of errors occur during that flow.
Yeah I don’t doubt there’s a bug in Convex Auth here, just trying to reproduce. I haven’t seen google oauth fail this way.
@erquhart Since I am using Google IDX, I can give you access so you don't have to clone anything.
You can inspect my code and see the logs also in the terminal.
Let me know if you think that will be useful.
Auth is a fundamental feature for my app that I am building. So it would be awesome if this can be figured out 🥲
I personally have tried searching but seems like this is an issue in Convex Auth itself.
The logs contain "No existing users found, creating new user" because at that point my users table was empty.So when you first log in with Google, it works. Meaning the user is created. Then when you refresh the page, the users table is empty - when does it become empty? Or does the first login somehow work without a user ever being created?
No no, the users table doesn't get empty.
I myself empty the table. So it's not like users table is getting cleared automatically.
And it's also not about the 1st time and second time.
No matter if I try it the 1st time or 2nd time, the behavior is the same.
When I am redirected back to the "/" route, I am just not authenticated.
Okay, so this issue here, it's not actually your issue, is that correct https://github.com/get-convex/convex-auth/issues/193
GitHub
Fix Google OAuth session persistence after page refresh · Issue #1...
Description Issue When logging in via Google authentication, the user session doesn't persist after refreshing the browser page. Convex logs show the error message "Invalid verification co...
Yes
That issue says google login works correctly, but then on refresh it fails
You're saying it just never works
Yeah in my case also, the users table does contain new user entries.
The problem is the session persistence.
When you first log in with Google, does it work?
Like, you're authenticated, user can do things in your app, etc
Or does it not, meaning you're still at the sign in page and it doesn't actually authenticate the user
When I get redirected at "/" route, I am not in an authenticated state, but in the users table indeed there is a new user entry.
It does authenticate the user, but somehow when the user goes to "/' route after the Google sing in flow, he is not in an authenticated state.
Any chance you're able to make a minimal repro?
So I hope it's clear, that authentication is working, The user is being created, but the session is not persistent
I understand the callout about session persistence, but there are three distinct and separate points of failure being described between your report and the other user in that issue, and I'm not able to repro any of it
Like, this demo site uses Convex Auth with Google, and works: https://convex-v1.run/
Create v1
A free, open-source starter kit for your next project, built with insights from Midday.
I would say the best and the most efficient thing is going to be that I provide you access to my Google IDX workspace then you can freely see what's happening.
You can log into it yourself
So i need to determine what's different about your project that's triggering this bug (presumably in Convex Auth)
I'm not familiar with IDX, can I use it to run your app and repro myself? Similar to cloning a repo?
You don't have to do anything. It's like I handed my vscode with my laptop to you.
You will have complete access to my code (all files front end/backend)
that works 👍
No cloning required
I mean, but can I run the code?
Yes you can
cool
feel free to dm
Whatever you will do, I will see it real time
or email
Whatever code you change or run. It's not like I can see your web cam etc 😅
yeah figured lol