fix: generate and store nonce in magic-link transaction for ID token …

[Piyush-85]

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

📋 Changes

Magic-link passwordless flows (send: 'link') now generate a nonce alongside state when building the authorization request. The nonce is:

• included in authParams forwarded to Auth0 in the /passwordless/start request body, so Auth0 embeds it in the magic link's authorization URL
• stored in the transaction cookie alongside state

When the magic link is followed and the callback completes the authorization code exchange, processAuthorizationCodeResponse receives the stored nonce as expectedNonce and verifies it matches the nonce claim in the returned ID token. Without this fix, expectedNonce was undefined and the check was silently skipped, an attacker who extracted an ID token from a completed magic-link flow could replay it in a different session.

OTP flows (send: 'code') are not affected — they do not use an authorization code callback and are not impacted by this change.

📎 References

• Identified during cross-review of feat: passwordless support auth0-server-python#134
• RFC 3986 / OpenID Connect Core §3.3 nonce binding requirement

🎯 Testing

New unit test in passwordless-server.flow.test.ts:

• Asserts nonce is present in authParams sent to Auth0
• Decrypts the transaction cookie and asserts the stored nonce matches the value forwarded to Auth0

Summary by CodeRabbit

• Bug Fixes
  • Improved magic-link sign-in security by including a nonce in the sign-in request and validating it during callback processing.
  • If the returned ID token nonce doesn’t match the expected value, the flow now fails safely without creating a session cookie.
• Tests
  • Added/extended coverage to verify the nonce is present in the /passwordless/start payload, stored in transaction state, and correctly enforced during callback nonce mismatch scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 196189d3-1f23-4e72-9e75-197a588323ee

📥 Commits

Reviewing files that changed from the base of the PR and between 2735b19 and 1a9dcd5.

📒 Files selected for processing (3)

• src/server/auth-client.test.ts
• src/server/auth-client.ts
• src/server/passwordless-server.flow.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• src/server/passwordless-server.flow.test.ts
• src/server/auth-client.ts

---

📝 Walkthrough

Walkthrough

The magic-link passwordless flow now generates a nonce, sends it in authorization parameters, and stores it in transaction state. Tests verify cookie persistence and reject callbacks with mismatched ID-token nonces.

Changes

Magic-link nonce flow

Layer / File(s)	Summary
Generate and persist magic-link nonce src/server/auth-client.ts	passwordlessStart generates a nonce and includes it in Auth0 authorization parameters and the saved magic-link transaction state.
Validate nonce handling src/server/passwordless-server.flow.test.ts, src/server/auth-client.test.ts	Tests verify the transaction-cookie nonce matches the authorization nonce and that callback processing rejects a mismatched ID-token nonce without creating a session.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• auth0/nextjs-auth0#2607: Introduces the related passwordlessStart magic-link flow.
• auth0/nextjs-auth0#2670: Modifies the same server-side passwordless flow and transaction state handling.

Suggested reviewers: psoltes, tusharpandey13

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: generating and storing a nonce in the magic-link transaction.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/magic-link-nonce

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.11%. Comparing base (019d1f8) to head (1a9dcd5).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2753   +/-   ##
=======================================
  Coverage   88.11%   88.11%           
=======================================
  Files          79       79           
  Lines       11105    11108    +3     
  Branches     2296     2296           
=======================================
+ Hits         9785     9788    +3     
  Misses       1276     1276           
  Partials       44       44           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[tusharpandey13]

Looks good, but can we add a test to check callback with mismatched ID-token nonce since we are now checking the nonce?