BREAKING CHANGE:
The required minimum version of `mongodb` has been bumped to v6, make sure to upgrade it in your project via `npm i mongodb@latest` or the equivalent
* feat: click up provider created
* docs: ClickUp documentation
* Format
---------
Co-authored-by: Antonio Basile <antoniobasile2@eng.it>
Co-authored-by: Thang Vu <hi@thvu.dev>
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/supabase-adapter": "0.0.0",
+ "@auth/supabase-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/xata-adapter": "0.0.0",
+ "@auth/xata-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/sequelize-adapter": "0.0.0",
+ "@auth/sequelize-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/pouchdb-adapter": "0.0.0",
+ "@auth/pouchdb-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
This package assumes that `globalThis.crypto` is available.
In older Node.js versions, you can polyfill by adding:
`globalThis.crypto ??= require("node:crypto").webcrypto`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/neo4j-adapter": "0.0.0",
+ "@auth/neo4j-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
This package assumes that `globalThis.crypto` is available.
In older Node.js versions, you can polyfill by adding:
`globalThis.crypto ??= require("node:crypto").webcrypto`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/firebase-adapter": "0.0.0",
+ "@auth/firebase-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
* feat: introduce `@auth/fauna-adapter`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/fauna-adapter": "0.0.0",
+ "@auth/fauna-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/mikro-orm-adapter": "0.0.0",
+ "@auth/mikro-orm-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
This package assumes that `globalThis.crypto` is available.
In older Node.js versions, you can polyfill by adding:
`globalThis.crypto ??= require("node:crypto").webcrypto`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/dynamodb-adapter": "0.0.0",
+ "@auth/dynamodb-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
This package assumes that `globalThis.crypto` is available.
In older Node.js versions, you can polyfill by adding:
`globalThis.crypto ??= require("node:crypto").webcrypto`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/dgraph-adapter": "0.0.0",
+ "@auth/dgraph-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
`fetch` is not polyfilled anymore.
In older Node.js versions, you can use the `--experimental-fetch` flag, or install `undici` and add the following line:
`globalThis.fetch ??= require("undici").fetch`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/upstash-redis-adapter": "0.0.0",
+ "@auth/upstash-redis-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
This package assumes that `globalThis.crypto` is available.
In older Node.js versions, you can polyfill by adding:
`globalThis.crypto ??= require("node:crypto").webcrypto`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/mongodb-adapter": "0.0.0",
+ "@auth/mongodb-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/typeorm-legacy-adapter": "0.0.0",
+ "@auth/typeorm-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/prisma-adapter": "0.0.0",
+ "@auth/prisma-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only.
* upgrade neo4j-driver
* Correcting depdendency to also allow for ^4.0.0 and pnpm install
---------
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Update size of icons on load && on resize event
Added 'use client' since window object would only be defined on client side ( and using hooks );
Thought it'd be a cool feature to add :)
* Apply suggestions from code review
---------
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* fix#6935: show close button.
* fix(global-css): show close button on annoucement bar
dev and build were generating different results, adding `!important` fixed on build.
BREAKING CHANGE:
Complete rewrite of the package. It is now published as ESM-only and written for `next-auth@4`. `next-auth@3` support is removed.
---------
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* added optional dynamic sveltekit options
* changed dynamicOptions function to async
* converted dynamicOptions to a named type
* updated inline docs to show async capabilities
* Update packages/frameworks-sveltekit/src/lib/index.ts
Co-authored-by: Thang Vu <hi@thvu.dev>
* Update packages/frameworks-sveltekit/src/lib/index.ts
Co-authored-by: Thang Vu <hi@thvu.dev>
* Update packages/frameworks-sveltekit/src/lib/index.ts
Co-authored-by: Thang Vu <hi@thvu.dev>
* Update packages/frameworks-sveltekit/src/lib/index.ts
Co-authored-by: Thang Vu <hi@thvu.dev>
* Update packages/frameworks-sveltekit/src/lib/index.ts
Co-authored-by: Thang Vu <hi@thvu.dev>
* refined to a simpler function signature
* removed redundant return statement
* Apply suggestions from code review
---------
Co-authored-by: Thang Vu <hi@thvu.dev>
* fix(adapters): comply to Node.js native ESM resolver for Firebase adapter
* fix import
* use single file
---------
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Bump @panva/hkdf to v1.0.3
Fixes#6736
* Update to v1.0.4
v.1.0.3 failed to publish it seems
* update lockfile
---------
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
BREAKING CHANGE:
- This package now only ships ESM, as all maintained Node.js versions have native support
- Dropped the `crypto` Node.js import in favor of `uuid`. When `globalThis.crypto` is the default in the future, we can remove `uuid` again
* add notion provider along with logo and styles
"
* adjust notion documentation
* update issue template with Notion provider
* update docs and provider with code from TomYeoman
* feat: move Notion provider to core
* get it working
---------
Co-authored-by: Harrison Broadbent <harrisonbroadbent@gmail.com>
Co-authored-by: Harrison Broadbent <harrisonbroadbent@Harrisons-MacBook-Air.local>
Co-authored-by: Thang Vu <hi@thvu.dev>
* Fix token expiry comparision in database strategy
fixes the condition used for example
in database strategy
* Apply suggestions from code review
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* feat: e2e test init
* run e2e test on CI
* Add credentials to ci
* Update pnpm-lock.yaml
* move test to dev
* add dotenv
* remove in examples
* add e2e command
* revert
* add output cache for turbo e2e
* correct path for upload artifact
* Update release.yml
* feat(pages): Redesigned all default pages according to sketches discussed.
* chore(signin): Remove console.log
* fix(css): Makes cards scale down to 320px and have a fixed width on larger screens
* fix(styling): Adds margins on bottom and top of card.
* chore(docs): Change the documentation according to changes. Uploaded new images that reflect the new pages.
* fix(next-auth/core): Fixes correct styling of provider button across browsers.
* chore(docs): Add doc string to beta docs aswell
* feat: move changes to core
* revert change in next-auth
Co-authored-by: Nico Domino <yo@ndo.dev>
Co-authored-by: Thang Vu <hi@thvu.dev>
revert signin
* chore(docs): Session management sample for Svelte
Added a code sample for managing the session through the $page store.
The sample demonstrates how to retrieve the session data in the root
+page.server.ts file and make it globally accessible through the $page
store, simplifying state management in the application. The previous
examples already used the data available in this store but did not show
how to set it.
* docs: Add authorization section to SvelteKit docs
This authorization section was added to make sure a few caveats with
SvelteKit were well documented to anyone using the library.
The problem is documented here: https://github.com/sveltejs/kit/issues/6315
Essentially, propagation of data between leafs is not guaranteed when
using the +layout.server.ts file as its load function is not guaranteed
to rerun every page change. The current approach to solve this is to do
authorization in each +page.server.ts file and additionally make sure to
grab the session data by awaiting the parent instead of directly
accessing the $page store, to make sure the information there is
current.
* docs: Fix small typesafety mistake in SvelteKit
PageLoad type should actually be PageServerLoad. Not setting this does
not actually generate any problems other than TypeScript complaining
that this type is not actually exported.
* docs: Add handle hook authorization management
Another way to handle authorization is through a path-based method. This
added part of the documentation uses the handle hook to protect certain
routes based on their path. The previous method which is per-component
is still present.
* docs: Simplify component approach for Svelte auth
Using event.locals.getSession() exposed by SvelteKitAuth instead of
relying in the root layout file making that available in the $page
store.
* docs: Complete SvelteKit authorization docs
Finalize the explanation for the URI-based approach and also clarify
interactions with the component-based approach.
* docs: Add formatting to vars in the SvelteKit docs
Format the variables like this: `var` so that it appears clearly as code
when reading the documentation.
Co-authored-by: Thang Vu <hi@thvu.dev>
* added function overload to getToken
* use MissingSecret error instead
* had wrong import
* change in core
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* fix(core): update CallbacksOptions.jwt docstring
Change description to reflect that JWT is encrypted by default
* update in core
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* docs(sveltekit): autogenerate API reference
* feat(sveltekit): update to use latest `@auth/core`
* chore: format
* chore: add auth packages as docs dependency
* chore: format
* chore: more formatting
* chore: don't run build before tests
- Cleans up logging. Logs are now color-coded, added more debug logs, and errors can include some simple metadata (like provider id) to know which provider caused an issue.
- All errors are exposed via `@auth/core/errors`. Each error has a URL like: https://errors.authjs.dev#errorcode in the terminal, which points to the documentation explaining the problem in detail, suggesting a fix.
- Added a bunch of documentation that autogenerates the pages under https://authjs.dev/reference/core/modules/main
- Renames `AuthHandler` to `Auth` and `AuthOptions` to `AuthConfig`
- Throwing an error in `signIn` callback will now be caught as a general error and will redirect to `/error?error=Configuration`. If the callback returns `false`, it will redirect to `/error?error=AccessDenied`.
* Directions to deploy outside Vercel
An additional ENV variable is needed when deploying with another service.
* Updated as suggested, AUTH_TRUST_HOST is a boolean
Add AUTH_TRUST_HOST for deploy outside Vercel
_Providing incorrect/insufficient information or skipping steps to reproduce the issue may result in closing the issue or converting to a discussion without further explanation._
_Providing incorrect/insufficient information or skipping steps to reproduce the issue will result in closing the issue and/or converting to a discussion without further explanation._
If you have a generic question specific to your project, it is best asked in Discussions under the [Questions category](https://github.com/nextauthjs/next-auth/discussions/new?category=Questions)
# Let's wait with this until adoption in other frameworks.
@@ -30,7 +30,7 @@ body:
Run this command in your project's root folder and paste the result:
Alternatively, you can manually gather the version information from your package.json for these packages: "next", "react" and "next-auth". Please also mention your OS and Node.js version, as well as the browser you are using.
Alternatively, you can manually gather the version information from your package.json for these packages: "next", "react" and "next-auth". Please also mention your OS and Node.js version, as well as the browser you are using.
Alternatively, if the above command did not work, we need the version of the following packages from your package.json: "next", "react", "next-auth" and your adapter. Please also mention your OS and Node.js version, as well as the browser you are using.
> - It's a good idea to open an issue first to discuss potential changes.
> - Please make sure that you are _NOT_ opening a PR to fix a potential security vulnerability. Instead, please follow the [Security guidelines](../Security.md) to disclose the issue to us confidentially.
> - Please make sure that you are _NOT_ opening a PR to fix a potential security vulnerability. Instead, please follow the [Security guidelines](https://github.com/nextauthjs/.github/blob/main/SECURITY.md) to disclose the issue to us confidentially.
@@ -14,9 +14,9 @@ Ensure the link is pointing to a codebase that is accessible (e.g. not a private
### **What happens if I don't provide a sufficient minimal reproduction?**
Issues with the `incomplete` label that receives no meaningful activity (e.g. new comments with a reproduction link) are automatically closed and locked after 30 days.
Issues with the `incomplete` label that receives no meaningful activity (e.g. new comments with a reproduction link) are closed after 7 days.
If your issue has _not_ been resolved in that time and it has been closed/locked, please open a new issue with the required reproduction.
If your issue has _not_ been resolved in that time and it has been closed/locked, please open a new issue with the required reproduction. (It's less likely that we check back on already closed issues.)
### **I did not open this issue, but it is relevant to me, what can I do to help?**
@@ -35,4 +35,3 @@ Upvoting issues to show your interest will help us prioritize and address them a
- [How to create a Minimal, Complete, and Verifiable example](https://stackoverflow.com/help/mcve)
- [Reporting a NextAuth.js bug](https://github.com/nextauthjs/next-auth/blob/main/.github/ISSUE_TEMPLATE/1_bug_framework.yml)
- [How to Contribute to Open Source (Next.js)](https://www.youtube.com/watch?v=cuoNzXFLitc)
Contributions and feedback on your experience of using this software are welcome.
This includes bug reports, feature requests, ideas, pull requests, and examples of how you have used this software.
Please see the [Code of Conduct](CODE_OF_CONDUCT.md) and follow any templates configured in GitHub when reporting bugs, requesting enhancements, or contributing code.
Please raise any significant new functionality or breaking change an issue for discussion before raising a Pull Request for it.
## For contributors
Anyone can be a contributor. Either you found a typo, or you have an awesome feature request you could implement, we encourage you to create a Pull Request.
Before contributing, we recommend you read the [Tour de Source: NextAuth.js](https://sourcegraph.com/notebooks/Tm90ZWJvb2s6MTc2MQ==) post to become more familiar with the libraries inner workings.
### Pull Requests
- The latest changes are always in `main`, so please make your Pull Request against that branch.
- Pull Requests should be raised for any change
- Pull Requests need approval of a [core contributor](https://next-auth.js.org/contributors#core-team) before merging
- We use ESLint/Prettier for linting/formatting, so please run `pnpm lint:fix` before committing to make resolving conflicts easier (VSCode users, check out [this ESLint extension](https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint) and [this Prettier extension](https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode) to fix lint and formatting issues in development)
- We encourage you to test your changes, and if you have the opportunity, please make those tests part of the Pull Request
- If you add new functionality, please provide the corresponding documentation as well and make it part of the Pull Request
### Setting up local environment
A quick guide on how to setup _next-auth_ locally to work on it and test out any changes:
1. Clone the repo:
```sh
git clone git@github.com:nextauthjs/next-auth.git
cd next-auth
```
2. Set up the correct pnpm version, using [Corepack](https://nodejs.org/api/corepack.html). Run the following in the project'a root:
```sh
corepack enable pnpm
```
(Now, if you run `pnpm --version`, it should print the same verion as the `packageManager` property in the [`package.json` file](https://github.com/nextauthjs/next-auth/blob/main/package.json))
Copy `apps/dev/.env.local.example` to `apps/dev/.env.local`, and add your env variables for each provider you want to test.
```sh
cd apps/dev
cp .env.local.example .env.local
```
> NOTE: You can add any environment variables to .env.local that you would like to use in your dev app.
> You can find the next-auth config under`apps/dev/pages/api/auth/[...nextauth].js`.
5. Start the developer application/server:
```sh
pnpm dev
```
Your developer application will be available on `http://localhost:3000`
That's it! 🎉
If you need an example project to link to, you can use [next-auth-example](https://github.com/iaincollins/next-auth-example).
#### Hot reloading
When running `pnpm dev`, you start a Next.js developer server on `http://localhost:3000`, which includes hot reloading out-of-the-box. Make changes on any of the files in `src` and see the changes immediately.
> NOTE: When working on CSS, you will have to manually refresh the page after changes. The reason for this is our pages using CSS are server-side rendered (using API routes). (Improving this through a PR is very welcome!)
> NOTE: The setup is as follows: The development application lives inside the `app` folder, and whenever you make a change to the `src` folder in the root (where next-auth is), it gets copied into `app` every time (gitignored), so Next.js can pick them up and apply hot reloading. This is to avoid some annoying issues with how symlinks are working with different React builds, and also to provide a super-fast feedback loop while developing core features.
#### Providers
If you think your custom provider might be useful to others, we encourage you to open a PR and add it to the built-in list so others can discover it much more easily! You only need to add two changes:
1. Add your config: [`src/providers/{provider}.js`](https://github.com/nextauthjs/next-auth/tree/main/packages/next-auth/src/providers) (Make sure you use a named default export, like `export default function YourProvider`!)
3. Add provider logo svgs, like `google-dark.svg` (dark mode) and `google.svg` (light mode) to the `/packages/next-auth/provider-logos/` directory. Don't forget to set the provider's styling options in the `provider.style` config object.
That's it! 🎉 Others will be able to discover this provider much more easily now!
You can look at the existing built-in providers for inspiration.
#### Databases
If you would like to contribute to an existing database adapter or help create a new one, head over to the [nextauthjs/adapters](https://www.github.com/nextauthjs/adapters) repository and follow the instructions provided there.
#### Testing
Tests can be run with `pnpm test`.
Automated tests are currently crude and limited in functionality, but improvements are in development.
## For maintainers
We use [a custom script](https://github.com/nextauthjs/next-auth/blob/main/scripts/release/index.ts) together with [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0) to automate releases. This makes the maintenance process easier and less error-prone. Please study the "Conventional Commits" site to understand how to write a good commit message.
When accepting Pull Requests, make sure the following:
- Use "Squash and merge"
- Make sure you merge contributor PRs into `main`
- Rewrite the commit message to conform to the `Conventional Commits` style.
- Using `fix` releases a patch (x.x.1)
- Using `feat` releases a minor (x.1.x)
- Using `feat` when `BREAKING CHANGE` is present in the commit message releases a major (1.x.x)
- Optionally link issues the PR will resolve (You can add "close" in front of the issue numbers to close the issues automatically, when the PR is merged. `semantic-release` will also comment back to connected issues and PRs, notifying the users that a feature is added/bug fixed, etc.)
### Skipping a release
If a commit contains `[skip release]` in their message, it will be excluded from the commit analysis and won't participate in the release type determination. This is useful, if the PR being merged should not trigger a new `npm` release.
Auth.js is a set of open-source packages that are built on Web Standard APIs for authentication in modern applications with any framework on any platform in any JS runtime.
See [authjs.dev](https://authjs.dev) for our framework-specific libraries, or check out [next-auth.js.org](https://next-auth.js.org) for `next-auth` (Next.js).
## Features
### Flexible and easy to use
- Designed to work with any OAuth service, it supports 2.0+, OIDC
- Built-in support for [many popular sign-in services](https://github.com/nextauthjs/next-auth/tree/main/packages/core/src/providers)
- Email/Passwordless authentication
- Bring Your Database - or none! - stateless authentication with any backend (Active Directory, LDAP, etc.)
- An open-source solution that allows you to keep control of your data
- Built-in support for [MySQL, MariaDB, Postgres, Microsoft SQL Server, MongoDB, SQLite, etc.](https://adapters.authjs.dev)
- Works great with databases from popular hosting providers
### Secure by default
- Promotes the use of passwordless sign-in mechanisms
- Designed to be secure by default and encourage best practices for safeguarding user data
- Uses Cross-Site Request Forgery (CSRF) Tokens on POST routes (sign in, sign out)
- Default cookie policy aims for the most restrictive policy appropriate for each cookie
- When JSON Web Tokens are used, they are encrypted by default (JWE) with A256GCM
- Features tab/window syncing and session polling to support short-lived sessions
- Attempts to implement the latest guidance published by [Open Web Application Security Project](https://owasp.org)
Advanced configuration allows you to define your routines to handle controlling what accounts are allowed to sign in, for encoding and decoding JSON Web Tokens and to set custom cookie security policies and session properties, so you can control who can sign in and how often sessions have to be re-validated.
### TypeScript
Auth.js libraries are written with type safety in mind. [Check out the docs](https://authjs.dev/getting-started/typescript) for more information.
## Security
If you think you have found a vulnerability (or are not sure) in Auth.js or any of the related packages (i.e. Adapters), we ask you to read our [Security Policy](https://authjs.dev/security) to reach out responsibly. Please do not open Pull Requests/Issues/Discussions before consulting with us.
## Acknowledgments
[Auth.js is made possible thanks to all of its contributors.](https://authjs.dev/contributors)
We request that you contact us directly to report serious issues that might impact the security of sites using NextAuth.js.
If you contact us regarding a serious issue:
- We will endeavor to get back to you within 72 hours.
- We will aim to publish a fix within 30 days.
- We will disclose the issue (and credit you, with your consent) once a fix to resolve the issue has been released.
- If 90 days has elapsed and we still don't have a fix, we will disclose the issue publicly.
The best way to report an issue is by contacting us via email at hi@thvu.dev, info@balazsorban.com, yo@ndo.dev and me@iaincollins.com, or raise a public issue requesting someone get in touch with you via whatever means you prefer for more details. (Please do not disclose sensitive details publicly at this stage.)
> For less serious issues (e.g. RFC compliance for unsupported flows or potential issues that may cause a problem in the future) it is appropriate to submit these publicly as bug reports or feature requests or to raise a question to open a discussion around them.
## Supported Versions
Security updates are only released for the current version.
Old releases are not maintained and do not receive updates.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
