Bug in OAUTH2 Sign-In

1

I’m using version 4.20.1 of Next-Auth in my Next.js project, with the login method signIn('patreon') and the following scopes: identity identity[email] identity.memberships.

These scopes should request the following three authorizations:

  • View Patreon identity info, including full name, account status, and connected social accounts;
  • View your email address;
  • View Patreon identity info, including full name, account status, connected social accounts, and pledge details, including status, amount, and history.

Popup Displaying 3 Authorization Requests:
image

However, randomly, even with all three scopes set, the authorization pop-up only requests permission for:

  • View Patreon identity info, including full name, account status, and connected social accounts.

Expected Popup with 3 Scopes, but Only 1 Permission is Requested:
image

This behavior causes an authorization error during login, and many users on our platform are experiencing this issue, which I believe is on the Patreon side.

If you’d like to test it in production, you can try logging in at our website multiple times (https://www.oppaiman.com) (18+ site). The behavior is intermittent, and randomly, one of the login attempts will request only the first authorization, despite having all 3 scopes set.

2

That page shows whatever scopes were sent to it, so its possible that your stack is not sending all the scopes or encoding them incorrectly. Scopes should have urlencoded space in between them.