locale is stripped out in callbackUrl and not respected when using a custom signIn page

[neotrow]

Environment

System: OS: Windows 10 10.0.22621 CPU: (24) x64 13th Gen Intel(R) Core(TM) i7-13700K Memory: 12.75 GB / 31.78 GB Binaries: Node: 18.16.0 - C:\Program Files\nodejs\node.EXE Yarn: 1.22.19 - ~\AppData\Roaming\npm\yarn.CMD npm: 9.5.1 - C:\Program Files\nodejs\npm.CMD Browsers: Edge: Spartan (44.22621.1992.0), Chromium (115.0.1901.188) Internet Explorer: 11.0.22621.1

Reproduction URL

https://github.com/neotrow/next-auth-locale-bug

Describe the issue

It seems that the locale is stripped out of the callbackUrl. Also with a custom signIn page the locale is not respected.

How to reproduce

• launch the app
• navigate to http://localhost:3000
• login (any credentials will work, no matter what username / password you enter)
• navigate to http://localhost:3000/en-GB
• you will see that it says: locale is en-GB and defaultLocale is de-CH
• now if you click sign out in the header you will get redirected to http://localhost:3000/api/auth/signin?callbackUrl=%2F but you should be redirect to http://localhost:3000/api/auth/signin?callbackUrl=%2Fen-GB
• your locale is lost and there is no way to retrieve it on the signin page

Expected behavior

I would expect two things:

• the callback url should include the locale. So it should redirect to http://localhost:3000/api/auth/signin?callbackUrl=%2Fen-GB
• if a custom singIn page is used i would expect the locale to be preserved. So let's assume i set the signIn page to /my-sign-in-page and i'm on /en-GB. If I click on signOut I would expect to be redirects to /en-GB/my-sign-in-page

[neotrow]

I think I found part of the issue:

https://github.com/nextauthjs/next-auth/blob/main/packages/next-auth/src/next/middleware.ts#L151

Here the locale from the nexUrl is not used.

It should be ${basePath}${locale}${pathname}${search}.

The defaultLocale is also supplied in the nextUrl. So I would say it makes sense to not include the locale if it's equal to the defaultLocale.

I can open a PR if that helps.

This would fix part one of my expected behaviour.

For part two I guess the signInPage should be prefixed with locale from nextUrl. Again it would make sense to only do this if it's not the default locale.