TypeError: "pkcs8" must be PKCS#8 formatted string on /api/login in Vercel logs

[michael5r]

After doing a preview deployment with Vercel, and then trying to log in on my site, the page just refreshes & I'm getting these errors in the Vercel logs:

TypeError: "pkcs8" must be PKCS#8 formatted string at (../../node_modules/jose/dist/browser/key/import.js:20:0) at (../../node_modules/next-firebase-auth-edge/lib/auth/jwt/sign.js:9:0) at (../../node_modules/next-firebase-auth-edge/lib/auth/jwt/crypto-signer.js:16:0) at (../../node_modules/next-firebase-auth-edge/lib/auth/token-generator.js:69:0) at (../../node_modules/next-firebase-auth-edge/lib/auth/index.js:228:0) at (../../node_modules/next-firebase-auth-edge/lib/next/cookies.js:130:0) at (../../node_modules/next/dist/esm/server/web/adapter.js:158:0)

[GET] [middleware: "middleware"] /api/login reason=EDGE_FUNCTION_INVOCATION_FAILED, status=500, user_error=true

Everything works fine locally.
I've tried using both 1.6.2 and 1.7.0-canary.10 of next-firebase-auth-edge - it didn't make a difference.

Output of npx next info:

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 23.4.0: Wed Feb 21 21:44:43 PST 2024; root:xnu-10063.101.15~2/RELEASE_ARM64_T6000
  Available memory (MB): 32768
  Available CPU cores: 10
Binaries:
  Node: 20.5.0
  npm: 9.8.0
  Yarn: 1.22.22
  pnpm: 8.6.10
Relevant Packages:
  next: 14.2.5 // There is a newer version (14.2.7) available, upgrade recommended!
  eslint-config-next: 14.2.5
  react: 18.3.1
  react-dom: 18.3.1
  typescript: 5.4.5

And this is what my middleware looks like:

import { NextRequest, NextResponse } from 'next/server';
import { authMiddleware } from 'next-firebase-auth-edge';
import { authConfig } from '~lib/firebase/server-config';

const AUTH_PATHS = ['/register', '/login', '/reset-password'];

const redirectToDashboard = (request: NextRequest) => {
    const url = request.nextUrl.clone();
    url.pathname = '/dashboard';

    return NextResponse.redirect(url);
};

export async function middleware(request: NextRequest) {
    return authMiddleware(request, {
        debug: true,
        loginPath: '/api/login',
        logoutPath: '/api/logout',
        refreshTokenPath: '/api/refresh-token',
        apiKey: authConfig.apiKey,
        cookieName: authConfig.cookieName,
        cookieSignatureKeys: authConfig.cookieSignatureKeys,
        cookieSerializeOptions: authConfig.cookieSerializeOptions,
        serviceAccount: authConfig.serviceAccount,
        checkRevoked: true,
        enableMultipleCookies: true,
        handleValidToken: async ({ token, decodedToken }, headers) => { // eslint-disable-line
            // Authenticated user should not be able to access /login, /register and /reset-password routes
            if (AUTH_PATHS.includes(request.nextUrl.pathname)) {
                return redirectToDashboard(request);
            }
            return NextResponse.next({
                request: {
                    headers
                }
            });
        }
    });
}

export const config = {
    matcher: [
        '/',
        '/((?!_next|favicon.ico|api|.*\\.).*)',
        '/api/login',
        '/api/logout',
        '/api/refresh-token'
    ]
};

[michael5r]

@awinogrodzki Any ideas as to what might be happening? If I bypass your library, I can sign in with Firebase just fine - it's only when it's going through your middleware that I get the errors.

[awinogrodzki]

Hey @michael5r!

Thanks for reporting!

This error usually happens when incorrect private key is provided. Could you inspect the value you pass as serviceAccount.privateKey? The private key should match PKCS8 format mentioned here

[michael5r]

You're absolutely right - the issue was that in the environment variables on vercel.com, the privateKey included double quotes at the beginning & end of the string:

Once I removed those double-quotes, the error disappeared. Thanks!

[awinogrodzki]

No worries! This is pretty common case, so probably I should re-throw this error with more user-friendly message. I will work on this soon :-)

[awinogrodzki]

More descriptive error message released in v1.7.0-canary.11