Duplicate nonce if custom nonce is set on iOS

[secure12]

Issue

My authConfig is something like so:

{
  useNonce: true,
  additionalParameters: {
    nonce: myCustomNonce
  }
}

When authorize is called, from Google I got: OAuth 2 parameters can only have a single value: nonce.

Looking into the source, on Android side, when nonce is set in additionalParameters, nonce is removed from additionalParameters after retrival:

react-native-app-auth/packages/react-native-app-auth/android/src/main/java/com/rnappauth/RNAppAuthModule.java

Lines 703 to 707 in 8fc717b

	if (additionalParametersMap.containsKey("nonce")) {
	authRequestBuilder.setNonce(additionalParametersMap.get("nonce"));
	additionalParametersMap.remove("nonce");
	}

However, on iOS, we have

react-native-app-auth/packages/react-native-app-auth/ios/RNAppAuth.m

Line 340 in 8fc717b

NSString *nonce = useNonce ? additionalParameters[@"nonce"]? additionalParameters[@"nonce"]: [[self class] generateState] : nil ;

And nonce is not removed from additionalParameters, whilst both nonce and additionalParameters are passed as parameters to OIDAuthorizationRequest.initWithConfiguration:

react-native-app-auth/packages/react-native-app-auth/ios/RNAppAuth.m

Lines 343 to 356 in 8fc717b

	OIDAuthorizationRequest *request =
	[[OIDAuthorizationRequest alloc] initWithConfiguration:configuration
	clientId:clientId
	clientSecret:clientSecret
	scope:[OIDScopeUtilities scopesWithArray:scopes]
	redirectURL:[NSURL URLWithString:redirectUrl]
	responseType:OIDResponseTypeCode
	state: additionalParameters[@"state"] ? additionalParameters[@"state"] : [[self class] generateState]
	nonce:nonce
	codeVerifier:codeVerifier
	codeChallenge:codeChallenge
	codeChallengeMethod: usePKCE ? OIDOAuthorizationRequestCodeChallengeMethodS256 : nil
	additionalParameters:additionalParameters];

AFAIK, AppAuth-iOS will then put both the nonce twice in the URL: https://github.com/openid/AppAuth-iOS/blob/77e32a8bbfb973966692854c974c7599973a0f59/Sources/AppAuthCore/OIDAuthorizationRequest.m#L333-L365

The fix would be to align iOS with Android - nonce should be removed from additionalParamters.

---

Environment

• Your Identity Provider: Google
• Platform that you're experiencing the issue on: iOS
• Your react-native Version: 0.83.6
• Your react-native-app-auth Version: 8.1.0
• Are you using Expo?: Yes

[secure12]

Update: I added patched authorizeWithConfiguration with the following after getting nonce from additionalParameters:

    if (additionalParameters[@"nonce"]) {
        NSMutableDictionary *mutableParams = [additionalParameters mutableCopy];
        [mutableParams removeObjectForKey:@"nonce"];
        additionalParameters = [mutableParams copy];
    }

And that went through properly.

[bryceknz]

Hi @secure12, thank you for your work on this! I have just merged #974 which resolved this issue 😊