Repository: auth0/auth0.js (js)

Issue:
Misleading error message on failed userinfo call
This test literally shows the bad error message: https://github.com/auth0/auth0.js/blob/master/test/web-auth/web-auth.test.js#L765

I am successfully using HS256 wiht auth0.js v9.3.1 and sporadically I see a confusing error log: `Algorithm HS256 is not supported. (Expected algs: [RS256])`

This means my user's internet had issues making the userinfo call. Please make this behaviour more clear! 

Pull request:
[don't merge] Fix hs256 idtoken userinfo fallback
fix #690 

Patch:
diff --git a/src/web-auth/index.js b/src/web-auth/index.js
index 31f0156..51d649c 100644
--- a/src/web-auth/index.js
+++ b/src/web-auth/index.js
@@ -123,7 +123,10 @@ function WebAuth(options) {
  *
  * Only validates id_tokens signed by Auth0 using the RS256 algorithm using the public key exposed
  * by the `/.well-known/jwks.json` endpoint of your account.
- * Tokens signed with other algorithms, e.g. HS256 will not be accepted.
+ * Tokens signed with the HS256 algorithm cannot be properly validated.
+ * Instead, a call to {@link userInfo} will be made with the parsed `access_token`.
+ * If the {@link userInfo} call fails, the {@link userInfo} error will be passed to the callback.
+ * Tokens signed with other algorithms will not be accepted.
  *
  * @method parseHash
  * @param {Object} options
@@ -201,7 +204,10 @@ WebAuth.prototype.parseHash = function(options, cb) {
  *
  * Only validates id_tokens signed by Auth0 using the RS256 algorithm using the public key exposed
  * by the `/.well-known/jwks.json` endpoint of your account.
- * Tokens signed with other algorithms, e.g. HS256 will not be accepted.
+ * Tokens signed with the HS256 algorithm cannot be properly validated.
+ * Instead, a call to {@link userInfo} will be made with the parsed `access_token`.
+ * If the {@link userInfo} call fails, the {@link userInfo} error will be passed to the callback.
+ * Tokens signed with other algorithms will not be accepted.
  *
  * @method validateAuthenticationResponse
  * @param {Object} options
@@ -287,7 +293,7 @@ WebAuth.prototype.validateAuthenticationResponse = function(options, parsedHash,
     return _this.client.userInfo(parsedHash.access_token, function(errUserInfo, profile) {
       // if the /userinfo request fails, use the validationError instead
       if (errUserInfo) {
-        return callback(validationError);
+        return callback(errUserInfo);
       }
       return callback(null, profile);
     });


Test patch:
diff --git a/test/web-auth/web-auth.test.js b/test/web-auth/web-auth.test.js
index ce77e3a..3e5f398 100644
--- a/test/web-auth/web-auth.test.js
+++ b/test/web-auth/web-auth.test.js
@@ -1223,7 +1223,7 @@ describe('auth0.WebAuth', function() {
           }
         );
       });
-      it('should throw validationError when /userinfo call has an error', function(done) {
+      it('should throw original userinfo error when /userinfo call has an error', function(done) {
         stub(this.webAuth.client, 'userInfo', function(accessToken, cb) {
           cb({ any: 'error' });
         });
@@ -1233,10 +1233,7 @@ describe('auth0.WebAuth', function() {
             hash: '#state=foo&access_token=VjubIMBmpgQ2W2&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2F1dGgwLXRlc3RzLWxvY2suYXV0aDAuY29tLyIsImlhdCI6MTUwOTA0MDk4MiwiZXhwIjoxNTQwNTc2OTgyLCJhdWQiOiJpeGVPSEZoRDdOU1B4RVFLNkNGY3N3alVzYTVZa2NYUyIsInN1YiI6Impyb2NrZXRAZXhhbXBsZS5jb20iLCJHaXZlbk5hbWUiOiJKb2hubnkiLCJTdXJuYW1lIjoiUm9ja2V0IiwiRW1haWwiOiJqcm9ja2V0QGV4YW1wbGUuY29tIiwiUm9sZSI6WyJNYW5hZ2VyIiwiUHJvamVjdCBBZG1pbmlzdHJhdG9yIl19._JvcLjX308NtT16oegF2wFeOcdEYKM3DqX-V4POwIeg&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
           },
           function(err, data) {
-            expect(err).to.be.eql({
-              error: 'invalid_token',
-              errorDescription: 'Algorithm HS256 is not supported. (Expected algs: [RS256])'
-            });
+            expect(err).to.be.eql({ any: 'error' });
             done();
           }
         );