Description:

Third-party login works in our external apps, up until Rocket Chat 7.3.3, but breaks with 7.4.0.

We host two apps where users can log in with their Rocket Chat accounts through OAuth2 via Rocket Chat's third-party login feature. The login flow takes the user to the confirmation dialogue, correctly calls the callback-url but seems to transmit a faulty code verifier. Ruby's OmniAuth library issues {"error":"invalid_grant","error_description":"Invalid grant: code verifier is invalid"}. A Python omniauth library also fails.

After reverting to 7.3.3. the login flow succeeds again.

Server Setup Information:

• Version of Rocket.Chat Server: 7.4.0
• License Type: Community
• Number of Users:
• Operating System: Ubuntu 24.04.1 LTS
• Deployment Method: docker
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version:
• MongoDB Version: 6.0.13

Client Setup Information

• Desktop App or Browser Version:
• Operating System:

Additional context

Relevant logs: