Martin
KKinde
•Created by Martin on 3/26/2024 in #💻┃support
User not receiving PIN to their email address
8 replies
KKinde
•Created by Martin on 2/1/2024 in #💻┃support
Wildcards in callback URLs bug
I'm trying to use https://kinde.com/docs/connect-to-kinde/callback-urls/#wildcards-in-callback-urls
With a wildcard callback URL configured, login fails with this message in my browser console:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://auth.inrange.dev/oauth2/token. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.
Can you help me with this?37 replies
KKinde
•Created by Martin on 12/18/2023 in #💻┃support
HTTP 429 Too Many Requests
My application makes some calls to the Kinde API from our backend. On Tuesday at 1:24pm (UTC) we saw a spike of HTTP 429 responses from the Kinde API. Can you help me understand the rate limits which apply to use of the Kinde API?
34 replies
KKinde
•Created by Martin on 11/29/2023 in #💻┃support
https://kinde.com/pricing/ M2M tokens question
11 replies
KKinde
•Created by Martin on 11/23/2023 in #💻┃support
Use of history.pushState in createKindeClient.ts
https://github.dev/kinde-oss/kinde-auth-pkce-js/blob/main/src/createKindeClient.ts
handleRedirectToApp(...) calls
window.history.pushState({}, '', url); on line 258. Is there any chance that this could be changed to https://developer.mozilla.org/en-US/docs/Web/API/History/replaceState? The use of pushState(...) means that a history entry gets generated which means that if a user click the Back button in their browser after login, they end up on back on the URL which has the ?code=... query args, which get stripped back out by Kinde and redirects them forward again to the page they just tried to press Back on.5 replies
KKinde
•Created by Martin on 11/19/2023 in #💻┃support
Restricting access to Kinde API
https://kinde.com/docs/user-management/user-permissions/ describes how I can create custom permissions for managing what the users of my application are allowed to do.
https://kinde.com/docs/build/add-a-m2m-application-for-api-access/ describes how I can enable M2M access to the Kinde API.
Is there any way to restrict which Kinde API methods are allowed to be called? I'd like to be able to restrict the access to ensure that if the Client Secret ever got leaked, it couldn't be used to delete all of my Users?
Related, does Kinde support any kind of Backup/Restore functionality to help recover from any kind of accidental / malicious data deletion?
5 replies
KKinde
•Created by Martin on 11/17/2023 in #💻┃support
Accessing appState
https://kinde.com/docs/developer-tools/react-sdk/#persisting-application-state gives an example for how to handle redirecting back to the page a user was on before they clicked the login button.
However, as per https://discord.com/channels/1070212618549219328/1161828367511859291/threads/1174693165748461628 I'm currently redirecting the user to a special page which handles making an API call to map them into an organisation based on some business logic. This means I want to wait until that API call completes before I redirect back to the original URL. To enable this I'm currently using a big hack:
Is there a better way of doing this? I couldn't see anything returned from
useKindeAuth() which exposed the appState.2 replies
KKinde
•Created by Martin on 11/17/2023 in #💻┃support
Rotating Client Secret
How and when can I rotate the client secret which I fetch as part of https://kinde.com/docs/build/add-a-m2m-application-for-api-access/?
2 replies
KKinde
•Created by Martin on 11/17/2023 in #💻┃support
Accessing ID on the backend
https://kinde.com/docs/developer-tools/protect-your-api/ describes setting the accessToken when making calls to an API. However, as per https://kinde.com/docs/build/about-access-tokens/ this token only includes the
Subject which is the Kinde User ID.
https://kinde.com/docs/build/about-id-tokens/ describes an ID token which includes details like the user's email, name, etc. However, I can't find any documentation about how to get a token like this and whether or not this would be appropriate to send up to my API, or whether I should be extracting the Kinde User ID from the Access Token and calling the Kinde API (https://kinde.com/api/docs/#get-user) to fetch the user details using this.
Can you help me understand this?3 replies
KKinde
•Created by Martin on 11/16/2023 in #💻┃support
Validating JWT tokens for non-OAuth mechanisms
Kinde supports non-OAuth mechanisms such as https://kinde.com/docs/authentication-and-access/azure/ (WS-Federation) and https://kinde.com/docs/authentication-and-access/custom-saml/.
Does Kinde take care of authenticating these logins and then convert the result into a JWT, or does my application need to also worry about handling these other kinds of credentials? Basically, if I follow https://kinde.com/docs/developer-tools/verifying-json-web-tokens/, will I be able to validate logins for users that completed their login using one of these non-OAuth mechanisms?
2 replies
KKinde
•Created by Martin on 11/16/2023 in #💻┃support
Enforcing permissions
https://kinde.com/docs/user-management/user-permissions/ talks about how to create permissions. How do I enforce these permissions in my frontend and backend API? I have a React frontend talking to a Python REST API.
3 replies