Closed nicholasprowse closed 10 months ago
We could not detect a valid reproduction link. Make sure to follow the bug report template carefully.
To be able to investigate, we need access to a reproduction to identify what triggered the issue. We need a link to a public GitHub repository. Example: (NextAuth.js example repository).
The bug template that you filled out has a section called "Reproduction URL", which is where you should provide the link to the reproduction.
Depending on the reason the issue was closed, you can do the following:
In general, assume that we should not go through a lengthy onboarding process at your company code only to be able to verify an issue.
In most cases, a private repo will not be a sufficient minimal reproduction, as this codebase might contain a lot of unrelated parts that would make our investigation take longer. Please do not make it public. Instead, create a new repository using the templates above, adding the relevant code to reproduce the issue. Common things to look out for:
Anyone experiencing the same issue is welcome to provide a minimal reproduction following the above steps by opening a new issue.
We look into every issue and monitor open issues for new comments.
However, sometimes we might miss a few due to the popularity/high traffic of the repository. We apologize, and kindly ask you to refrain from tagging core maintainers, as that will usually not result in increased priority.
Upvoting issues to show your interest will help us prioritize and address them as quickly as possible. That said, every issue is important to us, and if an issue gets closed by accident, we encourage you to open a new one linking to the old issue and we will look into it.
Environment
System: OS: macOS 13.3.1 CPU: (8) arm64 Apple M1 Memory: 344.88 MB / 16.00 GB Shell: 5.9 - /bin/zsh Binaries: Node: 20.7.0 - /usr/local/bin/node Yarn: 1.22.17 - /opt/homebrew/bin/yarn npm: 10.1.0 - /opt/homebrew/bin/npm Watchman: 2023.06.12.00 - /opt/homebrew/bin/watchman Browsers: Chrome: 116.0.5845.187 Safari: 16.4
Reproduction URL
Repo is private. See How to Reproduce to see how to make a minimal example that demonstrates the problem
Describe the issue
I recently upgraded from Nextjs 13.4.10 to 13.5.2, and pretty much all of my authentication using next-auth broke. After a few hours debugging it I have identified the issue. After upgrading to Nextjs 13.5, the cookies sent back from the server are not saved in development, because they are sent back with the Secure or Host prefix. Because the csrf is not stored, it is regenerated on each request, which breaks authentication. This is not an issue in production, because the __Secure prefix is expected when using https, but it breaks local development using http.
I may be wrong, but after diving into the code, I think I have found the problem: next-auth uses a combination of the
x-forwarded-proto
header and theVERCEL
env variable to determine if the request is coming from http or https (As can be seen here and here). If theVERCEL
variable is set, then thex-forwarded-proto
header is used to determine if the protocol is http or https, which determines if the Secure/Host prefixes are added to cookies. By default, vercel projects have theVERCEL
env variable set to"1"
, so I expect this will be a problem for all vercel projects running Nextjs 13.5.However, in Nextjs 13.5, the
x-forwarded-proto
is no longer sent in requests. Not sure why this was changed, but I just noticed it through my testing, and it results in next-auth assuming the protocol is https, when it is not.Like I said, the lack if the
x-forwarded-proto
header, results in next-auth assuming https, resulting in the cookies being sent with Secure/Host prefixes, which the browser rejects because the protocol is actually http.Note: this can be easily worked around by manually removing the
VERCEL
environment variable, however this isn't ideal, as vercel expects it to be there and every time I runvercel env pull
it adds back in the variable.How to reproduce
npm i next-auth
.env.local
file with contents:VERCEL="1"
app/api/auth/[...nextauth]/route.ts
file with contentsasync function handler(req, res) { console.log([...headers().keys()]) return await NextAuth(req, res, { providers: [] }) }
export { handler as GET, handler as POST }
[ 'accept', 'accept-language', 'cache-control', 'connection', 'cookie', 'host', 'pragma', 'sec-ch-ua', 'sec-ch-ua-mobile', 'sec-ch-ua-platform', 'sec-fetch-dest', 'sec-fetch-mode', 'sec-fetch-site', 'sec-fetch-user', 'upgrade-insecure-requests', 'user-agent', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-port', 'x-forwarded-proto', 'x-invoke-path', 'x-invoke-query', 'x-middleware-invoke' ]
[ 'accept', 'accept-encoding', 'accept-language', 'cache-control', 'connection', 'cookie', 'host', 'pragma', 'sec-ch-ua', 'sec-ch-ua-mobile', 'sec-ch-ua-platform', 'sec-fetch-dest', 'sec-fetch-mode', 'sec-fetch-site', 'sec-fetch-user', 'upgrade-insecure-requests', 'user-agent' ]