* feat(adapter): Add Azure Table Storage DB adapter
* add newlines
* remove sessionByUserId together with the session
* include import in the readme file
* add types to response objects
* introduce contracts for the db entities
* Rename the lib in docs
Co-authored-by: Nico Domino <yo@ndo.dev>
* run prettier
* feat: azure tables adapter
---------
Co-authored-by: Nikita Dmitriev <nikitadmitry@gmail.com>
Co-authored-by: Nikita Dmitriev <106996965+nikitaclicks@users.noreply.github.com>
Co-authored-by: Nico Domino <yo@ndo.dev>
Improve performance by avoiding call to parseDataSourceConfig before checking if _dataSource was already initialized.
Co-authored-by: Thang Vu <hi@thvu.dev>
Fix crash in azure-ad-b2c.ts
Not all b2c-setups return a list of emails. This fixes the resulting crash by using defensive access when setting the profile email address field.
Co-authored-by: Thang Vu <hi@thvu.dev>
* Add vanilla Postgres adapter for NextAuth using the pg package.
All tests are passing.
* Fix typo in readme
* Add basic tsconfig
* Replace this.getUser with functio body as this is undef
* Change name from @next-auth/postgres-adapter to @next-auth/pg-adapter
* Fix package folder to be same as name
* Add package to issue template, labeller and PR labeller
* Commit pnpm lock change.
* Set next-auth version to ^4
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Return user id when updating user. Fixes#4897.
* chore: format PR
* chore: format PR
* chore: formatting
* fix: tests
* fix
---------
Co-authored-by: Jake Coppinger <jake@jakecoppinger.com>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* cleaned everything up
* Added documentation
* fixed up d1 logo in docs
* cleaning out unused file
* changed to esm module
* formatting the PR
* update the deps
* update the deps
* ignore test
* ignore test
* fix deps
* add contributor
---------
Co-authored-by: Nico Domino <yo@ndo.dev>
Co-authored-by: Thang Vu <hi@thvu.dev>
BREAKING CHANGE:
The required minimum version of `mongodb` has been bumped to v6, make sure to upgrade it in your project via `npm i mongodb@latest` or the equivalent
* feat: click up provider created
* docs: ClickUp documentation
* Format
---------
Co-authored-by: Antonio Basile <antoniobasile2@eng.it>
Co-authored-by: Thang Vu <hi@thvu.dev>
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/supabase-adapter": "0.0.0",
+ "@auth/supabase-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/xata-adapter": "0.0.0",
+ "@auth/xata-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/sequelize-adapter": "0.0.0",
+ "@auth/sequelize-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/pouchdb-adapter": "0.0.0",
+ "@auth/pouchdb-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
This package assumes that `globalThis.crypto` is available.
In older Node.js versions, you can polyfill by adding:
`globalThis.crypto ??= require("node:crypto").webcrypto`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/neo4j-adapter": "0.0.0",
+ "@auth/neo4j-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
This package assumes that `globalThis.crypto` is available.
In older Node.js versions, you can polyfill by adding:
`globalThis.crypto ??= require("node:crypto").webcrypto`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/firebase-adapter": "0.0.0",
+ "@auth/firebase-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
* feat: introduce `@auth/fauna-adapter`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/fauna-adapter": "0.0.0",
+ "@auth/fauna-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/mikro-orm-adapter": "0.0.0",
+ "@auth/mikro-orm-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
This package assumes that `globalThis.crypto` is available.
In older Node.js versions, you can polyfill by adding:
`globalThis.crypto ??= require("node:crypto").webcrypto`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/dynamodb-adapter": "0.0.0",
+ "@auth/dynamodb-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
This package assumes that `globalThis.crypto` is available.
In older Node.js versions, you can polyfill by adding:
`globalThis.crypto ??= require("node:crypto").webcrypto`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/dgraph-adapter": "0.0.0",
+ "@auth/dgraph-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
`fetch` is not polyfilled anymore.
In older Node.js versions, you can use the `--experimental-fetch` flag, or install `undici` and add the following line:
`globalThis.fetch ??= require("undici").fetch`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/upstash-redis-adapter": "0.0.0",
+ "@auth/upstash-redis-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
This package assumes that `globalThis.crypto` is available.
In older Node.js versions, you can polyfill by adding:
`globalThis.crypto ??= require("node:crypto").webcrypto`
Database adapters are not dependent on Next.js features, so it makes sense to republish them under the `@auth/*` scope.
This PR is part of a series to convert adapters, using `@auth/core` for types.
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/mongodb-adapter": "0.0.0",
+ "@auth/mongodb-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/typeorm-legacy-adapter": "0.0.0",
+ "@auth/typeorm-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only
BREAKING CHANGE:
If you are coming from the previous adapter, change your `package.json`:
```diff
- "@next-auth/prisma-adapter": "0.0.0",
+ "@auth/prisma-adapter": "0.0.0",
```
And run `npm install`, `yarn install` or `pnpm install` respectively.
**Note:** This packages is published as ESM-only.
* upgrade neo4j-driver
* Correcting depdendency to also allow for ^4.0.0 and pnpm install
---------
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Update size of icons on load && on resize event
Added 'use client' since window object would only be defined on client side ( and using hooks );
Thought it'd be a cool feature to add :)
* Apply suggestions from code review
---------
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* fix#6935: show close button.
* fix(global-css): show close button on annoucement bar
dev and build were generating different results, adding `!important` fixed on build.
BREAKING CHANGE:
Complete rewrite of the package. It is now published as ESM-only and written for `next-auth@4`. `next-auth@3` support is removed.
---------
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* added optional dynamic sveltekit options
* changed dynamicOptions function to async
* converted dynamicOptions to a named type
* updated inline docs to show async capabilities
* Update packages/frameworks-sveltekit/src/lib/index.ts
Co-authored-by: Thang Vu <hi@thvu.dev>
* Update packages/frameworks-sveltekit/src/lib/index.ts
Co-authored-by: Thang Vu <hi@thvu.dev>
* Update packages/frameworks-sveltekit/src/lib/index.ts
Co-authored-by: Thang Vu <hi@thvu.dev>
* Update packages/frameworks-sveltekit/src/lib/index.ts
Co-authored-by: Thang Vu <hi@thvu.dev>
* Update packages/frameworks-sveltekit/src/lib/index.ts
Co-authored-by: Thang Vu <hi@thvu.dev>
* refined to a simpler function signature
* removed redundant return statement
* Apply suggestions from code review
---------
Co-authored-by: Thang Vu <hi@thvu.dev>
* fix(adapters): comply to Node.js native ESM resolver for Firebase adapter
* fix import
* use single file
---------
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Bump @panva/hkdf to v1.0.3
Fixes#6736
* Update to v1.0.4
v.1.0.3 failed to publish it seems
* update lockfile
---------
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
BREAKING CHANGE:
- This package now only ships ESM, as all maintained Node.js versions have native support
- Dropped the `crypto` Node.js import in favor of `uuid`. When `globalThis.crypto` is the default in the future, we can remove `uuid` again
* add notion provider along with logo and styles
"
* adjust notion documentation
* update issue template with Notion provider
* update docs and provider with code from TomYeoman
* feat: move Notion provider to core
* get it working
---------
Co-authored-by: Harrison Broadbent <harrisonbroadbent@gmail.com>
Co-authored-by: Harrison Broadbent <harrisonbroadbent@Harrisons-MacBook-Air.local>
Co-authored-by: Thang Vu <hi@thvu.dev>
* Fix token expiry comparision in database strategy
fixes the condition used for example
in database strategy
* Apply suggestions from code review
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* feat: e2e test init
* run e2e test on CI
* Add credentials to ci
* Update pnpm-lock.yaml
* move test to dev
* add dotenv
* remove in examples
* add e2e command
* revert
* add output cache for turbo e2e
* correct path for upload artifact
* Update release.yml
* feat(pages): Redesigned all default pages according to sketches discussed.
* chore(signin): Remove console.log
* fix(css): Makes cards scale down to 320px and have a fixed width on larger screens
* fix(styling): Adds margins on bottom and top of card.
* chore(docs): Change the documentation according to changes. Uploaded new images that reflect the new pages.
* fix(next-auth/core): Fixes correct styling of provider button across browsers.
* chore(docs): Add doc string to beta docs aswell
* feat: move changes to core
* revert change in next-auth
Co-authored-by: Nico Domino <yo@ndo.dev>
Co-authored-by: Thang Vu <hi@thvu.dev>
revert signin
* chore(docs): Session management sample for Svelte
Added a code sample for managing the session through the $page store.
The sample demonstrates how to retrieve the session data in the root
+page.server.ts file and make it globally accessible through the $page
store, simplifying state management in the application. The previous
examples already used the data available in this store but did not show
how to set it.
* docs: Add authorization section to SvelteKit docs
This authorization section was added to make sure a few caveats with
SvelteKit were well documented to anyone using the library.
The problem is documented here: https://github.com/sveltejs/kit/issues/6315
Essentially, propagation of data between leafs is not guaranteed when
using the +layout.server.ts file as its load function is not guaranteed
to rerun every page change. The current approach to solve this is to do
authorization in each +page.server.ts file and additionally make sure to
grab the session data by awaiting the parent instead of directly
accessing the $page store, to make sure the information there is
current.
* docs: Fix small typesafety mistake in SvelteKit
PageLoad type should actually be PageServerLoad. Not setting this does
not actually generate any problems other than TypeScript complaining
that this type is not actually exported.
* docs: Add handle hook authorization management
Another way to handle authorization is through a path-based method. This
added part of the documentation uses the handle hook to protect certain
routes based on their path. The previous method which is per-component
is still present.
* docs: Simplify component approach for Svelte auth
Using event.locals.getSession() exposed by SvelteKitAuth instead of
relying in the root layout file making that available in the $page
store.
* docs: Complete SvelteKit authorization docs
Finalize the explanation for the URI-based approach and also clarify
interactions with the component-based approach.
* docs: Add formatting to vars in the SvelteKit docs
Format the variables like this: `var` so that it appears clearly as code
when reading the documentation.
Co-authored-by: Thang Vu <hi@thvu.dev>
* added function overload to getToken
* use MissingSecret error instead
* had wrong import
* change in core
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* fix(core): update CallbacksOptions.jwt docstring
Change description to reflect that JWT is encrypted by default
* update in core
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* docs(sveltekit): autogenerate API reference
* feat(sveltekit): update to use latest `@auth/core`
* chore: format
* chore: add auth packages as docs dependency
* chore: format
* chore: more formatting
* chore: don't run build before tests
- Cleans up logging. Logs are now color-coded, added more debug logs, and errors can include some simple metadata (like provider id) to know which provider caused an issue.
- All errors are exposed via `@auth/core/errors`. Each error has a URL like: https://errors.authjs.dev#errorcode in the terminal, which points to the documentation explaining the problem in detail, suggesting a fix.
- Added a bunch of documentation that autogenerates the pages under https://authjs.dev/reference/core/modules/main
- Renames `AuthHandler` to `Auth` and `AuthOptions` to `AuthConfig`
- Throwing an error in `signIn` callback will now be caught as a general error and will redirect to `/error?error=Configuration`. If the callback returns `false`, it will redirect to `/error?error=AccessDenied`.
* Directions to deploy outside Vercel
An additional ENV variable is needed when deploying with another service.
* Updated as suggested, AUTH_TRUST_HOST is a boolean
Add AUTH_TRUST_HOST for deploy outside Vercel
* feat: add signin button styles
* fix: remove unnecessary spans
chore: rm comments
* Update packages/next-auth/src/core/pages/signin.tsx
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* feat: add provider svgs to repo
* fix: adjust SVG sizes
* fix: adjust provider btn to logo links
* feat: apple provider btn style
* fix: add apple-dark svg
* feat: atlassian logo and style
* feat: auth0 logo and style
* feat: azure logo and style
* fix: azure logo size
* feat: battlenet logo and style
* feat: box logo and style
* feat: cognito logo and style
* feat: discord logo and style
* feat: facebook logo and style
* feat: foursquare logo and style
* fix: foursquare logo size
* feat: freshbooks logo and style
* feat: gitlab logo and style
* fix: gitlab logo whitespace
* feat: hubspot logo and style
* feat: instagram logo and style
* feat: keycloak logo and style
* feat: keycloak logo resize
* feat: linkedin logo and style
* feat: mailchimp logo and style
* feat: okta logo and style
* feat: update okta logos
* feat: patreon logo and style
* fix: okta logo viewbox
* feat: slack logo and style
* feat: spotify logo and style
* feat: todoist logo and style
* fix: spotify logo size
* feat: trakt logo and style
* feat: twitch logo and style
* feat: twitter logo and style
* feat: vk logo and style
* feat: wikimedia logo and style
* feat: workos logo and style
* fix: wikimedia-dark logo + twitter (legacy)
* fix: button:active styling
* fix: ignore eslint inline css custom properties warning
* fix: improve darkmode default btn stylign
* fix: swap github btn colors
* fix: swap line btn theme colors
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* feat(next): support Server Components with `unstable_getServerSession`
* chore: remove `.entries`
* docs(next): add documentation for RSC
* update beta docs
* chore(dev): add app dir
* fix text
* only show second warning if using with RSC
* only delete expires for RSC case
* feat(client): add `refetchWhenOffline` option
* docs(client): document `refetchWhenOffline` option
* add TODO comment for next major
* feat: improve refetch hook logic
* fix: add todo back
* chore: small refactoring
Co-authored-by: Thang Vu <hi@thvu.dev>
* Non vercel-specific way to forward host header
* Update packages/next-auth/src/utils/detect-host.ts
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* fix(middleware): improve handling of custom nextjs basePath
* fix(middleware): improve extraction of nextjs base path from req.nextUrl
* adapt to req.nextUrl.basePath
* Fix indent
* Add middleware test for custom-base and simplified code a little bit
* Fix indent
* Add another test
* Rename basePath and nextJsBasePath
* Fix lint error
* Add user id to `session` and `jwt` callback
* Minor changes
- Notes on why the id is not exposed by default is already documented in the `session` section.
* Apply suggestions from code review
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* docs(adapters): Add prisma client docs for typescript users
Add documentation for connecting prisma client w/ prisma adapter for typescript users.
* docs(adapters): remove prismadb.js for prismadb.ts
remove prismadb.js as it is identical to the prismadb.ts
* Apply suggestions from code review
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Update prisma.md
The referenced official doc page describes how to fix the `warn(prisma-client) There are already 10 instances of Prisma Client actively running.` error in development mode.
* Update prisma.md
Implemented best practice for Prisma Client creation.
* Fixed typo in Prisma db filename.
* fix(middleware): use `includes()` for NextAuth pages
Some users could be setting their `signIn` and `error` pages option to
`/` to disable the automatically generated pages, as suggested in [1].
This commit reverts the behaviour for matching `signIn` and `error`
pages in `handleMiddleware` to pre-v4.10.3.
```
const signInPage = "/"
const errorPage = "/"
const publicPaths = [signInPage, errorPage, "/_next", "/favicon.ico"]
// pathname = "/" will return true
publicPaths.some((p) => pathname.startsWith(p))
```
Fixes: aedabc8d ("fix: avoid redirect on always public paths")
Reference [1]: https://github.com/nextauthjs/next-auth/discussions/2330#discussioncomment-1678298
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* test(middleware): add tests for public paths
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
Co-authored-by: Thang Vu <thvu@hey.com>
* clean up `package.json` files
* chore(ts): make sure `next-auth/next` does not conflict with `next`
* simplify `turbo.json`
* fix: apply suggestion
* simplify doc dev command
* ignore upstash redis again
* ignore mikro orm for now
* chore: dev command
* update lock file
* update css path for dev only
* Update apps/dev/package.json
Co-authored-by: Thang Vu <thvu@hey.com>
* Send client_id and client_secret to linkedin
Linkedin now requires client_id and client_secret to be
sent in the oauth callback. Fixes#5220
* Update linkedin.ts
Co-authored-by: Thang Vu <thvu@hey.com>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* feat: added providing database name in options
* fix: added database name providing in readme
* Apply suggestions from code review
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* fix: return null in unstable_getServerSession if there's an error
* Remove status check and instead check body is not a string
* Combine similar tests
* Keep error from being logged twice
The same errors have been logged, firstly before throwing
OAuthCallbackError, later in the catch-clause of it.
This commit removes the former and lets the latter survive,
because logging functionality seems better to reside in the
same neighborhood.
* doc: Merge CALLBACK_OAUTH_ERROR to OAUTH_CALLBACK_ERROR
* doc: This particular error from openid-client comes with SIGNIN_OAUTH_ERROR
* Provide logger with `providerId`
Co-authored-by: Thang Vu <thvu@hey.com>
Co-authored-by: Thang Vu <thvu@hey.com>
* fix typo in faq
Added missing “not” in same root different subdomain config section warning text
* Apply suggestions from code review
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* feat: add nonce check type
* Update types import for nonce-handler.ts
* Update packages/next-auth/src/core/lib/oauth/callback.ts
Co-authored-by: Thang Vu <thvu@hey.com>
* Add further info to debug msg as per PR suggestion
* Cast OauthChecks as OpenIDCallbackChecks
* Update order of imports as per PR suggestion
Co-authored-by: Hamid Adelyar <hamid.adelyar@bjss.com>
Co-authored-by: hamidbjss <98807568+hamidbjss@users.noreply.github.com>
Co-authored-by: Thang Vu <thvu@hey.com>
Contains the following squashed commits:
* Added how to install next-auth
* Update docs/docs/getting-started/example.md
* Update docs/docs/getting-started/example.md
* Updated with suggestions in mind
* Update example.md
* type safe babel config
* avoid auth redirect for `_next`
* force render default error page on user miconfig
* add slash to _next path
* use `.some`
* add docs
* change from localhost
* add favicon to public path
Split a FAQ into two parts:
Before:
- Can I use NextAuth.js with a website that does not use Next.js?
After:
- Can I use NextAuth.js with a framework different than Next.js?
- Can session generated by NextAuth.js be used by another website?
Ports and refactors `@next-auth/firebase-adapter` to use the new Adapter API. Ported from this PR: nextauthjs/adapters#183
BREAKING CHANGE:
- Renames `FirebaseAdapter` export to `FirestoreAdpater`
- This adapter now requires firebase v9+
We haven't kept up with the recent TypeORM changes, and since they are still <1, it's likely that users kept upgrading, even if there were breaking changes.
BREAKING CHANGE:
[`typeorm`](https://github.com/typeorm/typeorm) is still in active development and has not yet published a stable release. Because of this, you can expect breaking changes in minor versions. This release of the adapter expects `typeorm@0.3.7` and is not validated against previous or future releases.
Run `npm i typeorm@latest` and make sure to read the [release notes](https://github.com/typeorm/typeorm/releases) for breaking changes in TypeORM
* ✨ provide secret via config
* 🐛 make secret optional
* 📝 docs for middleware and env var
* 📝 recommendation at the end of paragraph
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* chore: update docs regarding new server session API
* fix: add note about unstable_ API prefix
* Apply suggestions from code review
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* merge `main`, fix workspace dependencies
* chore(dev): use `matcher` in Middleware
* fix(middleware): support `cookies` as `Map`
* simplify
* chore(example): use new Middleware API
* chore(example): use `next-auth@latest`
* docs(middleware): document new Middleware API
* docs(ts): update inline example
* fix(ts): make cookies optional
* remove non-null assertion
* fix: signIn infer provider type
The "P" type it's not passed in any props, so the result type doesn't understand and return the false type always, Adding the "P" at provider type props.
* fix: P possibly undefined
Co-authored-by: arthurpedroti@gmail.com <arthurpedroti@LAPTOP-MVAK9RM5.localdomain>
in next Next.js versions, NextRequest.cookies will be an instance of NextCookies which is
some kind of a Map, instead of a plain object.
This commit checks whether there's a `get` function in req.cookies, and acts accordingly,
to make sure we will support newer Next.js versions with Edge Functions/Middleware
* Adding United Effects as a provider
* Update packages/next-auth/src/providers/united-effects.ts
* returning name and image as null in profile response
Co-authored-by: Lluis Agusti <hi@llu.lu>
The "P" type it's not passed in any props, so the result type doesn't understand and return the false type always, Adding the "P" at provider type props.
* feat: Add the support of custom cookieName on the next-auth/middleware
* chore: Only accept used params based on NextAuthConfig
* docs: Remove duplicated docs
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Use relative URL for middleware's signin callbackUrl
* Include params to callbackUrl if any
* For testing purpose, append params to existing link for test instead of create another one
* Update apps/dev/components/header.js
Co-authored-by: CODY Mai <nhan.mai@shiftasia.com>
Co-authored-by: Thang Vu <31528554+ThangHuuVu@users.noreply.github.com>
The Authentik provider already adds a `/` after the `issuer`, so this creates a double slash that causes a NextAuth `SIGNIN_OAUTH_ERROR` ("expected 200 OK, got: 301 Moved Permanently").
* chore(docs): add link to SIWE example app / tutorial
* chore(docs): add link to example signin page and cleanup
* chore: update copy for SIWE credentials provider example
* Add additional type
* do not cast to 'any' anymore
* add missing import
* import NextRequest from next/server
Co-authored-by: Lluis Agusti <hi@llu.lu>
* fix(core\pages\signin.tsx): set type of built-in email sign-in input to email for browse validation
* fix(core\pages\signin.tsx): add required attribute to built-in sign-in email input
Co-authored-by: Lluis Agusti <hi@llu.lu>
* docs: Update JWT docs to reflect JWE changes in v4
This PR https://github.com/nextauthjs/next-auth/pull/3039 changed the defaults for JWT tokens to be encrypted by default (JWE). We have conflicting documentation across the docs site and readme.
Additionatlly this PR https://github.com/nextauthjs/next-auth/pull/3783 made providing a secret required in production via NEXTAUTH_SECRET or an option.
* Missed a reference
* Update docs/docs/faq.md
Co-authored-by: Nico Domino <yo@ndo.dev>
* Update docs/docs/faq.md
Co-authored-by: Nico Domino <yo@ndo.dev>
Co-authored-by: Nico Domino <yo@ndo.dev>
* docs: fix Custom Client Session Handling example
It made reference to a useEffect call that was no longer needed.
* Update docs/docs/getting-started/client.md
Co-authored-by: Lluis Agusti <hi@llu.lu>
Co-authored-by: Lluis Agusti <hi@llu.lu>
* chore(docs): add carbon ads to docs page
* fix: add carbon-wrap element
* fix: script in docusaurus config object
* fix: add _carbonads_js id
* fix: add script directly to sidebar
* fix: carbon ads style
* chore: bump ad container down a bit
BREAKING CHANGE
From now on, you will need a minimum version of `@upstash/redis@v1` installed if you want to use this adapter.
You can upgrade by running `npm i @upstash/redis@latest` or `yarn add @upstash/redis@latest`
Until we migrate to v1 there might be people installing the latest
version of @upstash/redis and then encountering errors.
With this they will at least get a warning.
This is obsolete and should be updated once
https://github.com/nextauthjs/next-auth/issues/4183 is resolved.
Co-authored-by: Balázs Orbán <info@balazsorban.com>
I saw in the documentation that v4 now uses
session: {
strategy: "jwt"
},
instead of
session: {
jwt: true
},
also there was double ;; at the end of the return statement, fixing it
* added saml-jackson provider
* incorporated code review changes
* fixed SAMLJacksonProfile type
* trying to adjust code for monorepo
* cleanup from merge with main
* updated docs link
* added example
* consistent naming
* Incorporated code review changes:
- env var default values moved to env.local.example
- consistent naming and use of id
* email is guaranteed to be present
This field is already nullable in the database, so this should only
affect types.
Because the type is being widened, not narrowed, this should also be
fully backwards-compatible, since pre-existing custom entities of type
`string` will be substitutable for the new default type of `string |
null`.
See #4055 for more specifics on the impact.
* chore: separate build commands for core and app
* Move emitDeclarationOnly to next-auth
* Update release.yml
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* refactor(dev): moved dev app
* chore(dev): fix dev app
* fix(providers): WorkOS to TS, use `client_secret_post`
* chore: decrease test concurrency
* chore: remove org
* chore: run tests sequentially
* feat(providers): use `picture` in WorkOS if available
* fix labeler
* try fixing test runs in GitHub Actions
* pass flags to test command
* test version pr
* move versoin-pr action
* remove --dry-run flag
* re-enable testing, re-add semantic release for now
* add docs
* use `yarn.lock` and different docs port
* simplify dev app config
* fix coverage report
* fix provider source links
* fix more links
* fix(providers): properly warn when using Twitter OAuth 2
* refactor(providers): move Twitter OAuth2 warning to `assert`
* fix: use proper warning code
* refactor: only set boolean
* Fix: Add OpenID to authorization scope
* Fix: Check for valid profile picture response before converting to base64
* Update src/providers/azure-ad.ts
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Confirm that profile photo was returned
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* feat(providers): add support to Twitter OAuth 2.0
* docs: add docs comment
* chore: cleanup
* chore: remove comments
* chore: give warning for OAuth 2 for now
* Added patreon provider - tested and working
* Update src/providers/patreon.js
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Update src/providers/patreon.js
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Update src/providers/patreon.js
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Update src/providers/patreon.js
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Switched to TS, restore .env.local, restore package.json as per comments on the PR
* chore: ran Prettier
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* fix: add eslintIgnore in package.json
* Let eslint runs in app, config + js files
* Add a separate tsconfig.eslint.json file
We want to run the lint command on `app`, `src` and `config`, but at the same time want `tsc` to compile files in `src` only. A separate `tsconfig.eslint.json` is a suitable solution to satisfy both `eslint` and `tsc`: 04d1f3e549/packages/parser/README.md
* Update client.ts
Set custom.setHttpOptionsDefaults before Issuer.discover(.wellKnown). This allow discover the .wellKnown endpoint behind a proxy
* chore: address code review
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Update strava.js
Auth with Strava was throwing errors before, this works.
* Update strava.js
changed according to commenters' suggestions
* chore: run linter
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Ensure that GitHub provider always gives an email
* Update src/providers/github.js
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* fix(provider): correct authorization for Atlassian
* feat(providers): use wellKnown for better configuration
* fix(atlassian): switch back to raw config
* fix(providers): pass generic to `OAuthUserConfig`
Co-authored-by: Lluis Agusti <hi@llu.lu>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* refactor EVEOnlineProvider into typescript, fix default scopes
* Update src/providers/eveonline.ts
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* update to new OIDC SSO endpoints
* set idToken: true
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Added support for zoom in beta
* Converted to typescript
* rename
* Now reflects response from Zoom
* chore: Prettier
Co-authored-by: Balázs Orbán <info@balazsorban.com>
If the expected cookie size would exceed the 4096 bytes most browsers allow, we split up the cookie value and put the content into multiple cookies, then assemble it upon reading it back. This eliminates the need for a database or user-land solutions in case the user wants to save more data or is constrained by their IdP for certain fields.
With no scope defined, it sets `openid` by default, which is an invalid 42 scope.
Co-authored-by: Alaa Zorkane <alaazorkane@gmail.com>
Co-authored-by: Alaa Zorkane <alaazorkane@gmail.com>
BREAKING CHANGE:
The `session.jwt: boolean` option has been renamed to `session.strategy: "jwt" | "database"`. The goal is to make the user's options more intuitive:
1. No adapter, `strategy: "jwt"`: This is the default. The session is saved in a cookie and never persisted anywhere.
2. With Adapter, `strategy: "database"`: If an Adapter is defined, this will be the implicit setting. No user config is needed.
3. With Adapter, `strategy: "jwt"`: The user can explicitly instruct `next-auth` to use JWT even if a database is available. This can result in faster lookups in compromise of lowered security. Read more about: https://next-auth.js.org/faq#json-web-tokens
Example:
```diff
session: {
- jwt: true,
+ strategy: "jwt",
}
```
* feat(react): preserve history on client-side navigation
* chore(deps): upgrade jest
* test(client): use absolute URL since `whatwg-*` refusing relative URLs
Updates the `jose` and `openid-client` packages.
BREAKING CHANGE:
The `jwt` option has been simplified and the NextAuth.js issued JWT is now encrypted by default.
If you want to override the defaults, you can still use the `encode` and `decode` functions. These are advanced options and they should only be used if you know what you are doing.
The default secret generation has been removed in this PR, which will be added back in a separate one. Remember, that is only for developer convenience, it is **highly** recommended to always create your own secret for production.
Spreading the object into the input tag allows developers to specify any attribute for the input tag used in the builtin sign-in page, such as 'autocomplete', 'autofocus', etc.
Removed the hardcoded attributes which just set the defaults of the 'input' tag and won't cause any behavior change in case they are absence from the object.
Signed-off-by: Gegham Zakaryan <zakaryan.2004@outlook.com>
* chore(dev): add CognitoProvider to dev app
* feat(log): log `error_description` in OAuth callback
* fix(providers): migrate Cognito to v4
* docs: mention superblog.ai for infra support
* fix: return profile picture for Cognito
* fix(ts): add picture to CognitoProfile
Add some very minimal customization to the built-in pages so people might not immediately need to replace them. This way they can customize some things with their brand color and add their company/project logo. We explicitly **do not** want to go overboard styling this page. This is not an authentication component library or Next.js app template!
Example:
```js
export default NextAuth({
providers: [...],
jwt: {...},
theme: {
colorScheme: 'auto',
brandColor: '#67b246',
logo: 'https://company.com/assets/logo.png'
}
})
```
BREAKING CHANGE:
`staleTime` (previously `clientMaxAge`) has been removed. Check out `refetchInterval` instead. It should cover most of the cases. If not, we can look into adding this back later on.
When using the default settings of the Github provider, with the "user" scope, it grants read/write access to profile info only. By changing to "read:user" and "user:email" it will only request read-only access https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps
BREAKING CHANGE:
By default, the GitHub Provider scope won't ask for full write access to user profiles. If you need that, you will now have to add the `user` scope to your configuration.
MS Docs has a lot of local language translations, so it's best to remove locale information from the URLs so that when someone follows them, they land on the right language version of the content.
BREAKING CHANGE:
`prisma-legacy` is now gone. Use `@next-auth/prisma-adapter`. Any features from the old adapter will be migrated over to the new one eventually. This is done so we can require the same default set of options from all the built-in providers, rather than allowing ambiguity on what an official adapter has to support.
The `TypeORM` adapter will probably be the only one migrated as-is, but in the future, we would like to break it down to lighter-weight adapters that only support single databases.
Adapters no longer have to return a `getAdapter()` method, they can return the actual adapter methods instead. All the values previously being provided through the arguments of `getAdapter` will now be available in a more digestible format directly in the concerning methods. This behavior was created so that connections could be handled more efficiently. Our review has shown that currently, the TypeORM adapter is the only one that does not handle connections out-of-the-box, so we are going to look into how we can create a wrapper/util function to make it work in the new version. For all other adapters, this will be a huge gain, as with this new API, methods are actually overrideable without creating a whole new custom adapter! 🥳
Example:
```js
function MySlightlyCustomAdapter(...args) {
const adapter = AdapterFromSomeoneElse(...args)
adapter.someMethodIWantToModify = (...args) => {
// Much better implementation goes here.
}
return adapter
}
```
**The following method names are changing:**
```diff
- getSession
+ getSessionAndUser
```
This method now requires that you return both the user and the session as `{user, session}`. If any of these could not be retrieved, you will have to return `null` instead. (In other words, this must be a transaction.) This requires one less database call, improving the user session retrieval. Any expiry logic included in the Adapter before is now done in the core as well.
```diff
- createVerificationRequest
+ createVerificationToken
```
Better describes the functionality. This method no longer needs to call `provider.sendVerificationRequest`, we are moving this into the core. This responsibility shouldn't have fallen to the adapter in the first place.
`createVerificationToken` will now receive a `VerificationToken` object, which looks like this:
```ts
interface VerificationToken {
identifier: string
expires: Date
token: string
}
```
The token provided is already hashed, so nothing has to be done, simply write it to your database. (Here we lift up the responsibility from the adapter to hash tokens)
```diff
- getVerificationRequest
+ useVerificationToken
```
Better describes the functionality. It now also has the responsibility to delete the used-up token from the database. Most ORMs should support retrieving the value while deleting it at the same time, so it will reduce the number of database calls.
``` diff
- deleteVerificationRequest
```
This method is gone. See `useVerificationToken`.
Most of the method signatures have been changed, have a look at the [TypeScript interface](ba4ec5faa3/types/adapters.d.ts) to get a better picture.
Adds a new way to import providers for modularity and better tree-shaking.
BREAKING CHANGE:
Providers now have to be imported one-by-one:
Example:
```diff
- import Provider from "next-auth/providers"
- Providers.Auth0({...})
+ import Auth0Provider from "next-auth/providers/auth0"
+ Auth0Provider({...})
```
> This touches on all OAuth providers, so there is a big potential for breaking by default. We have let new providers be added for contributors' specific needs, but from now on, we will require a more strict default on all new providers, so the basic behavior is predictable for everyone.
⚠ Unfortunately, we will not have the capacity to test each and every provider that has been added to the default providers, but we will do our best to test the most popular ones. (@ndom91 has worked on setting up the infrastructure for this). If you wish to make sure that the provider you are using will stay working, please reach out with your concerns and tell us how can you help us test that particular provider in the future. 🙏
That said, I will try my best to not break ANY of the currently built-in providers, or at least make the migration super easy. So hopefully, you won't have to change anything. It will most probably affect you if you defined a custom provider though.
We will monitor the default configuration much more closely, so the behavior will be more consistent across providers by default.
Closes#1846, Closes#1605, Closes#1607
BREAKING CHANGES:
Basecamp provider is removed. See the explanation [here](https://github.com/basecamp/api/blob/master/sections/authentication.md#on-authenticating-users-via-oauth)
**ALL** OAuth providers' `profile` callback is expected to only return these fields by default from now on: `id`, `name`, `email`, and `image` at most. Any of these missing values should be set to `null`.
The following new options are available:
1. `authorization` (replaces `authorizationUrl`, `authorizationParams`, `scope`)
2. `token` replaces (`accessTokenUrl`, `headers`, `params`)
3. `userinfo` (replaces `profileUrl`)
These three options map nicely to the OAuth spec's three endpoints for
1. initiating the login flow
2. retrieve OAuth tokens
3. retrieve user information
They all take the form of `EndpointHandler`:
```ts
type EndpointRequest<C, R> = (
context: C & {
/** `openid-client` Client */
client: Client
/** Provider is passed for convenience, ans also contains the `callbackUrl`. */
provider: OAuthConfig & {
signinUrl: string
callbackUrl: string
}
}
) => Awaitable<R>
/** Gives granular control of the request to the given endpoint */
type AdvancedEndpointHandler<P extends UrlParams, C, R> = {
/** Endpoint URL. Can contain parameters. Optionally, you can use `params`*/
url?: string
/** These will be prepended to the `url` */
params?: P
/**
* Control the corresponding OAuth endpoint request completely.
* Useful if your provider relies on some custom behavior
* or it diverges from the OAuth spec.
*
* - ⚠ **This is an advanced option.**
* You should **try to avoid using advanced options** unless you are very comfortable using them.
*/
request?: EndpointRequest<C, R>
}
/** Either an URL (containing all the parameters) or an object with more granular control. */
type EndpointHandler<P extends UrlParams, C = any, R = any> =
| string
| AdvancedEndpointHandler<P, C, R>
```
In case of `authorization`, the `EndpointHandler` can define the `params` as [`AuthorizationParameters`](51dc47d9ac/types/index.d.ts (L108-L143))
> Note: `authorization` does not implement `request` yet. We will have to see if there is demand for it.
From now on, instead of using the `...` spread operator when adding a new built-in provider, the user is expected to add `options` as a property at the end of the default config. This way, we can deep merge the user config with the default one. This is needed to let the user do something like this:
```js
MyProvider({
clientId: "",
clientSecret: "",
authorization: { params: {scope: ""} }
})
```
So even if the default config defines anything in `authorization`, only the user-defined parts will be overridden.
* chore(deps): add openid-client
* chore: merge in next
* refactor(provider): remove redundant requestUrl param
* feat(provider): make profile callback optional
* refactor: use openid-client for OAuth2/OIDC
* refactor: use openidClient in oauth signin handler
* refactor: use openidClient in oauth callback handler
* docs(warn): add async issuer/old config warnings
* chore(deps): remove jsonwebtoken
* chore: add issuer property for testing locally
* chore(dev): import providers one-by-one
* fix(oauth): handle when no user in body/query
* chore(deps): remove pkce-challenge
* chore(dev): change Auth0 protection
* refactor(oauth): simplify pkce/state
* refactor: split OAuth1 client, reduce openid client
will improve API in another PR
* chore: change comment, dev app
* chore: mention OIDC client config discovery
* fix: add new operator when creating OIDC client
* refactor: delete req.query.nextauth after use
* docs(ts): use `TokenSet` from `openid-client`
* chore: simplify/type signin route
* refactor: rename to client-legacy to indicate intnet of maintenance
* chore(deps): try setting `oauth` as optional peer dep
* chore(deps): add `oauth` back as regular dependency
* chore(deps): add @types/oauth as dev dependency
* chore: remove params kept for backwards compatibility
* chore: don't make breaking changes in this PR
* chore(core): use correct TS declarations
* refactor: move files/add more accurate types internally
* chore: remove TODO comment
* chore: catch all errors in authorization URL generation
* docs(readme): add opencollective details to readme
* docs(www): add sponsors to docs footer
* docs(readme): move support under ack
* docs(www): dropped docusaurus link in footer
* Update Fauna Adapter
- added one-liner to explain how to use the setup scripts inside of the Fauna dashboard
- updated the `verification_request_by_token` index name to match what is expected inside of the SDK which is `verification_request_by_token_and_identifier`
* Update Typo
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Unified API for all of our user-facing methods.
NOTE: `events.error` has been removed. This method has never been called in the core, so it did actually nothing. If you want to log errors to a third-party, check out the [`logger`](https://next-auth.js.org/configuration/options#logger) option instead.
BREAKING CHANGE:
Two event signatures changed to use named params, `signOut` and `updateUser`:
```diff
// [...nextauth].js
...
events: {
- signOut(tokenOrSession),
+ signOut({ token, session }), // token if using JWT, session if DB persisted sessions.
- updateUser(user)
+ updateUser({ user })
}
```
Similar to #2342, this aims to unify the user-facing API and provide an easier way to extend in the future.
In addition, this PR also solves the problem when the `logger.error` method sometimes did not print results, because `Error` instances are not serializable and will be printed as empty objects `"{}"`.
After this PR, we make any `Error` instances serializable as described here: https://iaincollins.medium.com/error-handling-in-javascript-a6172ccdf9afCloses#1602
Achieved by adding a `client: true` flag when logs are coming from the frontend.
BREAKING CHANGE:
The main change is that instead of an unknown number of parameters, the log events have at most two, where the second parameter is usually an object. In the case of the `error` event, it can also be an `Error` instance (that is serializable by `JSON.stringify`). If it is an object, an `Error` instance will be available on `metadata.error`, and `message` will default to `metadata.error.message`. This is done so that an error event always provides some kind of a stack to see where the error happened
```diff
// [...nextauth.js]
import log from "some-logger-service"
...
logger: {
- error(code, ...message) {},
+ error(code, metadata) {},
- warn(code, ...message) {},
+ warn(code) {}
- debug(code, ...message) {}
+ debug(code, metadata) {}
}
```
This change aligns the API with `openid-client`'s `checks` https://github.com/panva/node-openid-client/blob/main/docs/README.md#clientcallbackredirecturi-parameters-checks-extras, a library which we intend to migrate to in the future. Aligning our API early, so people get used to it.
Also, objectively the name `protection` might not have been as clear as I first thought. `checks` better describe the intention.
BREAKING CHANGE:
The `state` option on OAuth providers is now deprecated. Use `checks: ["state"]` instead.
`protections` is renamed to `checks`, here is an example:
```diff
- protection: ["pkce"]
+ checks: ["pkece"]
```
Furthermore, string values are not supported anymore. This is to be able to handle fewer cases internally.
```diff
- checks: "state"
+ checks: ["state"]
```
A living session could be a requirement for specific pages (like dashboards). If it doesn’t exist, the user should be redirected to a page asking them to sign in again.
Sometimes, a user might log out by accident, or by deleting cookies on purpose. If that happens (e.g. on a separate tab), then `useSession({ required: true })` should detect the absence of a session cookie and always return a non-nullable Session object type.
When `required: true` is set, the default behavior will be to redirect the user to the sign-in page. This can be overridden by an `action()` callback:
```js
const session = useSession({
required: true,
action() {
// ....
}
})
if (session.status === "Loading") return "Loading or not authenticated..."
// session.data is always defined here.
```
Co-authored-by: Kristóf Poduszló <kripod@protonmail.com>
Co-authored-by: Lluis Agusti <hi@llu.lu>
BREAKING CHANGE:
The `useSession` hook now returns an object. Here is how to accommodate for this change:
```diff
- const [ session, loading ] = useSession()
+ const { data: session, status } = useSession()
+ const loading = status === "loading"
```
With the new `status` option, you can test states much more clearly.
* (docs) initial issue template forms as per #2271
* (typo) fix grammar and typo
* (forms) make the requested changes
* (chore) delete the old .md files
* (forms) fix type key
Some of our user-facing callbacks come with a bunch of parameters, and it is not always the case that a user needs all of them. Picking out certain parameters from the end of the list would require the user to define params that they wouldn't even need.
Therefore this PR changes such callbacks so the user can only pick the necessary parameters.
This comes with the bonus of better TS support on the `session` and `signIn` callbacks, where some parameters historically could have been different types.
In the `session` callback, the second param could have been `token` (when using JWT sessions) or `user` (when using DB persisted sessions). Now they are separate parameters.
In the `signIn` callback, we now separate `profile` (OAuth), `email` (Email) and `credentials` (Credentials) provider params.
BREAKING CHANGE:
The `callbacks` method signatures are changing the following way:
```diff
- signIn(user, account, profileOrEmailOrCredentials)
+ signIn({ user, account, profile, email, credentials })
```
```diff
- redirect(url, baseUrl)
+ redirect({ url, baseUrl })
```
```diff
- session(session, tokenOrUser)
+ session({ session, token, user })
```
```diff
- jwt(token, user, account, OAuthProfile, isNewUser)
+ jwt({ token, user, account, profile, isNewUser })
```
> NOTE: You only need to define the params that you actually need (no more need for `_` params.)
This way, if you only need `token` and `account` in the `jwt` callback, you can write:
```js
jwt({ token, account }) {
if(account) {
token.accessToken = account.access_token
}
return token
}
```
Node 10 has reached end-of-life, Next.js stopped supporting it in Next 11. Since we are a Next.js library, it doesn't make sense for us to support anything lower than that either.
I also upgraded a bunch of dependencies and dropped some that weren't necessary anymore.
BREAKING CHANGE:
The lowest supported Node version is 12. (We still support IE11 in browsers, until that is not dropped by Next.js itself)
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Add useState dependency
I went to execute the signin.js file and received an error that useState was undefined. Was able to reconcile this by adding the dependency.
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Sangwon Park <dev.psw@gmail.com>
* fix(docs): scope expects space separated string
Currently the docs list string[] as possible type for scope.
However, It only accepts a string (with space as separator).
Co-authored-by: Balázs Orbán <info@balazsorban.com>
commit 665445818e
Author: Balázs Orbán <info@balazsorban.com>
Date: Sat Jun 12 17:11:53 2021 +0200
docs(config): link to next documentation instead of canary
commit 67cf2a11bb
Author: ndom91 <yo@ndo.dev>
Date: Sat Jun 12 16:42:48 2021 +0200
docs: fix alt client provider example
**What**:
These changes ensure that we work more tightly with React that can also result in unforeseen performance boosts. In case we would decide on expanding to other libraries/frameworks, a new file per framework could be added.
**Why**:
Some performance issues (https://github.com/nextauthjs/next-auth/issues/844) could only be fixed by moving more of the client code into the `Provider`.
**How**:
Refactoring `next-auth/client`
Related: #1461, #1084, #1462
BREAKING CHANGE:
**1.** `next-auth/client` is renamed to `next-auth/react`.
**2.** In the past, we exposed most of the functions with different names for convenience. To simplify our source code, the new React specific client code exports only the following functions, listed with the necessary changes:
- `setOptions`: Not exposed anymore, use `SessionProvider` props
- `options`: Not exposed anymore, use `SessionProvider` props
- `session`: Rename to `getSession`
- `providers`: Rename to `getProviders`
- `csrfToken`: Rename to `getCsrfToken`
- `signin`: Rename to `signIn`
- `signout`: Rename to `signOut`
- `Provider`: Rename to `SessionProvider`
**3.** `Provider` changes.
- `Provider` is renamed to `SessionProvider`
- The `options` prop is now flattened as the props of `SessionProvider`.
- `clientMaxAge` has been renamed to `staleTime`.
- `keepAlive` has been renamed to `refetchInterval`.
An example of the changes:
```diff
- <Provider options={{clientMaxAge: 0, keepAlive: 0}}>{children}</Provider>
+ <SessionProvider staleTime={0} refetchInterval={0}>{children}</SessionProvider>
```
**4.** It is now **required** to wrap the part of your application that uses `useSession` into a `SessionProvider`.
Usually, the best place for this is in your `pages/_app.jsx` file:
```jsx
import { SessionProvider } from "next-auth/react"
export default function App({
Component,
pageProps: { session, ...pageProps }
}) {
return (
// `session` comes from `getServerSideProps` or `getInitialProps`.
// Avoids flickering/session loading on first load.
<SessionProvider session={session}>
<Component {...pageProps} />
</SessionProvider>
)
}
```
* feat(adapter): remove built-in adapters and database
BREAKING CHANGE:
From now on, you will have to import your own adapter
Check out https://github.com/nextauthjs/adapters
The migration is super easy and has HUGE advantages for those not using TypeORM.
```diff
// [...nextauth].js
+ import TypeORMAdapter from "@next-auth/typeorm-legacy-adapter"
import NextAuth from "next-auth"
...
export default NextAuth({
- database: "yourconnectionstring",
+ adapter: TypeORMAdapter("yourconnectionstring")
})
```
Co-authored-by: Lluis Agusti <hi@llu.lu>
Co-authored-by: Giovanni Carnel <479046+g10@users.noreply.github.com>
Contains the following squashed commits:
* chore(lint): run prettier on pre-commit
* chore(lint): format files on pre-commit
* chore(npm): update lock file
* docs(adapters): reorganise adapter docs for new pkg
* docs(adapters): fix link typos
* docs(adapters): add vercel.json redirects for new adapters URLs
I'm not sure when this changed, but it's no longer true. If the person logging in doesn't have a stored user account, the ID will be the provider_account_id
* docs: explain where pageProps come from in Provider docs
* chore: formatting
* docs(getting-started): add alternative client session handling methods
* docs(getting-started): update alternative client api docs
* Constrain the adapters type generics more accurately
* Add types for the incoming messages to events callbacks
* Code review comments from @lluia
* Rebase from trunk and fix merge conflicts
* Update documentation
* Rip out generics
* fix(build): export aliases from client (#1909)
* docs(provider): update providers documentation (#1900)
* docs(providers): update providers documentation
- delineate clearly the 3 provider types (oauth, email, credentials)
- make each section structure consistent
- update the option list for every provider type
- use emojis
* docs(providers): instructions on new provider types
* docs(providers): remove emojis
To stay consistent with the rest of our documentation, for now we should not emojis on the sections of our documentation pages.
* docs(providers): reword sentence
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* docs(providers): add tip on overriding options
* docs(providers): clarify `params` option usage
* docs(providers): make names list inline
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* fix(ts): unset generics defaults for overriding (#1891)
Co-authored-by: Lluis Agusti <hi@llu.lu>
* fix(ts): tweak Adapter related types (#1914)
Contains the following squashed commits:
* fix(ts): make first adapter parameter non-optional
* fix(ts): make defaulted values non-optional internally
* test(ts): fix linting
* fix(page): don't pass params to custom signout page (#1912)
* For the custom signout page addressed two issues with the query params being added to the signout url. A conditional check on the error value is now made before adding it as a query param. Also added a conditional check on the callbackUrl and if present that then gets appended as a query param to the signout api call.
* Changed fix for bug #192 to have no querystring params in the custom signout page url.
Co-authored-by: anubisoft <anubisoftprez@gmail.com>
Co-authored-by: Lluis Agusti <hi@llu.lu>
* docs(www): fix typo (#1922)
* docs(provider): Update IdentityServer 4 demo configuration (#1932)
* Responding to code review comments
* Fix tests
* Fix lint error
Co-authored-by: Lluis Agusti <hi@llu.lu>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Kristóf Poduszló <kripod@protonmail.com>
Co-authored-by: Anubisoft <1471887+anubisoft@users.noreply.github.com>
Co-authored-by: anubisoft <anubisoftprez@gmail.com>
Co-authored-by: Ernie Miranda <emiranda04@users.noreply.github.com>
Co-authored-by: Mathis Møller <thisen-dk@hotmail.com>
* For the custom signout page addressed two issues with the query params being added to the signout url. A conditional check on the error value is now made before adding it as a query param. Also added a conditional check on the callbackUrl and if present that then gets appended as a query param to the signout api call.
* Changed fix for bug #192 to have no querystring params in the custom signout page url.
Co-authored-by: anubisoft <anubisoftprez@gmail.com>
Co-authored-by: Lluis Agusti <hi@llu.lu>
Contains the following squashed commits:
* fix(ts): make first adapter parameter non-optional
* fix(ts): make defaulted values non-optional internally
* test(ts): fix linting
* docs(providers): update providers documentation
- delineate clearly the 3 provider types (oauth, email, credentials)
- make each section structure consistent
- update the option list for every provider type
- use emojis
* docs(providers): instructions on new provider types
* docs(providers): remove emojis
To stay consistent with the rest of our documentation, for now we should not emojis on the sections of our documentation pages.
* docs(providers): reword sentence
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* docs(providers): add tip on overriding options
* docs(providers): clarify `params` option usage
* docs(providers): make names list inline
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* chore(github): fix typos on issue templates...
* chore(github): use statements rather than comments
on the PR template
* chore(github): Typescript -> TypeScript
* chore(github): add links to Codesanbox on issue templates
* Apply suggestions from code review
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* chore: move dev app to its own folder
* docs: update CONTRIBUTING.md
* docs: fix typos in CONTRIBUTING
* chore: gitignore dev app lock files
* chore: move release config into package.json
* chore: add beta to release flow/GH actions
* feat(ts): expose types from the package (#1665)
* chore(types): move existing types to the repo
* feat(ts): expose types from the main package
* chore(deps): bring back `react-dom` version range
* chore(ts): cleanup deps and comments
* chore(ci): run types tests on a separate workflow
* chore(ci): fix typo on types workflow
* fix(ts): correctly export sub-module types (#1677)
* chore(types): build types script
Adds a script that moves the declaration files we have in `./types` to `./dist` relative to the files they intend to type.
This is the first step, we still need to change what we declare in `package.json`, add the script to the CI pipeline if we're happy with it and figure out how to type `next-auth/jwt`.
* refactor(lint): fix build-types script
* fix(ts): add .d.ts sub-module files to package.json
#1677 seemed to miss this
* fix(built): typo in package.json
* fix(build): fix release
* feat(ts): support module augmentation (#1681)
* chore(ts): remove unused imports
* refactor(ts): clean up CallbackOptions
* docs(ts): explain Module Augmentation
* docs(ts): don't use @ in folder name "types"
* test(ts): make jwt params optional
* docs(ts): fix typo (TypeScript -> NextAuth.js)
* style: replace ts-standard with eslint/prettier (#1724)
* style: move from ts-standard to eslint/prettier
* fix: install remaining eslint-config-standard peer deps
* fix: add remaining missing dependencies/config
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* docs(lint): update contributing.md (#1760)
Regarding ESLint / Prettier use and link to their VSCode extensions
* refactor(ts): de-duplicate types (#1690)
* refactor(ts): deduplicate internal types
* refactor(ts): ease up providers typings
* test(ts): fix failing TS tests
* test(ts): rename TS property to fix test
* docs(ts): mention TS docs in README.md
* feat(ts): move/update client types
* refactor(TS): rename some types
* test(ts): fix client tests
* docs(ts): move function descriptions to .d.ts
* chore: fix lint error
* refactor(ts): separate internal types
* chore: simplify build-types script
* chore: update type import paths in src
* chore(build): create root files at build
* chore: remove unnecessary .npmignore
* chore: run prettier on types
* fix(ts): clean up jwt types
* fix(ts): make getToken return type depend on raw param
* docs(page): explain page errors, add theming note
* docs(ts): add JSDoc to NextAuthOptions props
* chore(ts): remove unused import
* docs(ts): change JSDOC docs notation
* refactor(build): extract module entries into enum
* chore(ts): move ClientSafeProvider
* chore(ts): simplify GetTokenParams generic
* style(lint): fix linting errors
* chore: re-add generic extension to GetTokenParams
* fix(ts): extract EmailConfigServerOptions to interface
* fix(ts): use relative imports
* Merge branch 'main' into beta
* Merge main into beta
* fix(ts): fix typos, add more links to documentation
* test(ts): update JWT getToken test
* fix(build): fix tsconfig.json formatting
* test(ts): use absolute imports in test files
* fix(ts): add missing callbacks JSDoc
* docs: mention TS in FAQ, fix typos
* docs: fix some typos in the docs
Co-authored-by: Lluis Agusti <hi@llu.lu>
Co-authored-by: Nico Domino <yo@ndo.dev>
* feat(build): optionally include TypeORM
If the user doesn't use databases,
it shouldn't be necessary to iclude it in the bundle.
This can more than half the package size!
* feat(build): clean up in dependencies
Remove unused dependencies, move optional ones to be optional
* feat(build): add exports field
* fix: use peerDependenciesMeta instead of non-standard peerOptionalDependecns field
* fix: ts-standard string quotes
* fix: ts-standard string quotes
* refactor: use asnyc/await for sendVerificationRequest
* chore(deps): upgrade mongodb, remove require_optional
Co-authored-by: ndom91 <yo@ndo.dev>
BREAKING CHANGE:
`typeorm`, and `nodemailer` are no longer dependencies added by default.
If you need any of them, you will have to install them yourself in your project directory.
TypeOrm is the default adapter, so if you only provide an `adapter` configuration or a `database`, you will need `typeorm`. You could also check out `@next-auth/typeorm-adapter`. In case you are using the Email provider, you will have to install `nodemailer` (or you can use the choice of your library in the `sendVerificationRequest` callback to send out the e-mail.)
* chore: alias dev script to next
* feat(core): fallback to body when reading state
* refactor: set csrfToken on req.options implicitly
Ensures we do this similarly than
in other handlers like pkce, state, extendRes, callbackUrlHandler etc.
* chore: add code comment for debugging
This fixes the a mismatch between the import (`csrfToken`) and the method (`getCsrfToken`) used in `getInitialProps`/`getServerSideProps`.
In addition the form input fields now have their correct type: `email` for email input (for better autocomplete, virtual keyboard support and native validation) and `password` for the password input (to hide password while typing).
* Update pages.md
Updated Credentials Sign-In code example to indicate how to use `getServerSideProps` but still also showing the older `getInitialProps` example
* Update www/docs/configuration/pages.md
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* update documentation to show example using getServerSideProps()
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Jay Liew <jay@haute.tech>
* Add missing error message and technique to resolve
* Update errors.md
Correct with correct error message and more complete suggestions on resolving it
This is fixing #1467.
The issue was due to doing the `setLoading(false)` in the finally: as we can do an early return [here](a7e08e2a32/src/client/index.js (L100-L100)), we would still go to the finally and mark the session as being loaded.
I simply removed the `finally` block to only set the `loading` state to false when:
- the data is ready
- an error occures
Changed `encodeURIComponent(error)` to `encodeURIComponent(error.message)` to remove prefix (such as `Error: ` and possible stack trace).
Seems like better way of doing it and also safer if server throws some error with sensitive data.
* feat: allow to disable client-side redirect for email provider
* docs(client): mention that redirect can also be disabled for email provider
* feat: only display one email input in email page
* added character encoding fix
* changed multi-line to inline and added title param to send fn in src/server/pages/index.js
* modified the return object of renderPage in src/server/pages/index.js
* docs(tutorials): refresh token rotation
* use simple initialization
* be optimistic
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* add yarn.lock to .gitignore
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* feat: make access_token available in profile callback
* docs(provider): mention access_token param in profile callback
* feat: send all available tokens to provider.profile
BREAKING CHANGE: adding `state: true` is already redundant
as `protection: "state` is the default value. `state: false`
can be substituted with `protection: "state"`
BREAKING CHANGE: We have supported throwing strings
for redirections, while we were showing a waring.
From now on, it is not possible. The user MUST return a string,
rather than throw it.
* feat: simplify NextAuth instantiation (#911)
* feat: allow react 17 as a peer dependency (#819)
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* docs: update for Now to Vercel (#847)
Vercel archived their now packages a while back, so you can use vercel env pull to pull in the .env
* docs: fix discord example code (#850)
* docs: fix typo in callbacks.md (#815)
This is a simple typographical error changed accesed to accessed
* fix: update nodemailer version in response to CVE. (#860)
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7769 reports a high-severity issue with the current version of nodemailer. This should be merged and released right away if possible.
* fix: ensure Images are produced for discord (#734)
* fix: update Okta routes (#763)
the current routing for the Okta provider does not follow the standard
set by Okta, and as such doesn't allow for custom subdomains. this
update amends the routes to allow for customer subdomains, and also
aligns next-auth with Okta's documentation.
* fix(provider): handle no profile image for Spotify (#914)
* chore(deps): upgrade "standard"
* style(lint): run lint fix
* fix(provider): optional chain Spotify provider profile img
* Merge main into canary (#917)
* chore: use stale label, instead of wontfix
* chore: add link to issue explaining stalebot
* chore: fix typo in stalebot comment
* chore: run build GitHub Action on canary also
* chore: run build GitHub Actions on canary as well
* chore: add reproduction section to questions
* docs: Update default ports for support Databases (#839)
https://next-auth.js.org/configuration/databases
* Fix for Reddit Authentication (#866)
* Fixed Reddit Authentication
* updated fix for build test
* updated buffer to avoid deprecation message
* Updated for passing tests
* WIP: Update Docusaurus + Site dependencies (#802)
* update: deps
* fix: broken link
* fix: search upgrade change
* Include callbackUrl in newUser page (#790)
* Include callbackUrl in newUser page
* Update src/server/routes/callback.js
Co-authored-by: Iain Collins <me@iaincollins.com>
* Update src/server/routes/callback.js
Co-authored-by: Iain Collins <me@iaincollins.com>
Co-authored-by: Iain Collins <me@iaincollins.com>
Co-authored-by: Nico Domino <yo@ndo.dev>
* add(db): Add support for Fauna DB (#708)
* Add support for Fauna DB
* Add integration tests
Co-authored-by: Nico Domino <yo@ndo.dev>
* feat(provider): add netlify (#555)
Co-authored-by: styxlab <cws@DE01WP777.scdom.net>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* Bump next from 9.5.3 to 9.5.4 in /test/docker/app (#759)
Bumps [next](https://github.com/vercel/next.js) from 9.5.3 to 9.5.4.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/compare/v9.5.3...v9.5.4)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Nico Domino <yo@ndo.dev>
* feat(provider): Add Bungie (#589)
* Add Bungie provider
* Use absolute URL for images
* Correct image URL and use consistent formatting
Co-authored-by: Nico Domino <yo@ndo.dev>
* feat: add foursquare (#584)
* feat(provider): Add Azure Active Directory B2C (#921)
* add provider: Microsoft
* documentation
* support no tenant setup
* fix code style
* chore: rename Microsoft provider to AzureADB2C
* chore: alphabetical order in providers/index
* doc: add provider to FAQ
* update(provider): Update Slack provider to use V2 OAuth endpoints (#895)
* Update Slack to v2 authorize urls, option for additional authorize params
* acessTokenGetter + documentation
* refactor(db): update Prisma calls to support 2.12+ (#881)
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Nico Domino <yo@ndo.dev>
* chore(dep): Bump highlight.js from 9.18.1 to 9.18.5 (#880)
Bumps [highlight.js](https://github.com/highlightjs/highlight.js) from 9.18.1 to 9.18.5.
- [Release notes](https://github.com/highlightjs/highlight.js/releases)
- [Changelog](https://github.com/highlightjs/highlight.js/blob/9.18.5/CHANGES.md)
- [Commits](https://github.com/highlightjs/highlight.js/compare/9.18.1...9.18.5)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Nico Domino <yo@ndo.dev>
* chore: disallow issues without template
* chore: add note about conveting questions to discussions
* chore: create PULL_REQUEST_TEMPLATE.md
* chore: reword PR template
* feat: Store user ID in sub claim of default JWT (#784)
This allows us to check if the user is signed in when using JWTs
Part of #625
* docs: fix incorrect references in cypress docs (#932)
* chore: use stale label, instead of wontfix
* chore: add link to issue explaining stalebot
* chore: fix typo in stalebot comment
* chore: run build GitHub Action on canary also
* chore: run build GitHub Actions on canary as well
* chore: add reproduction section to questions
* feat(provider): Add Azure Active Directory B2C (#809)
* add provider: Microsoft
* documentation
* support no tenant setup
* fix code style
* chore: rename Microsoft provider to AzureADB2C
* chore: alphabetical order in providers/index
* Revert "feat(provider): Add Azure Active Directory B2C (#809)" (#919)
This reverts commit 6e6a24a7af.
* chore: add myself to the contributors list 🙈
* docs: fix incorrect references in cypress docs
* chore: add additional docs clarification
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Vladimir Evdokimov <evdokimov.vladimir@gmail.com>
* feat: Display error if no [...nextauth].js found (#678)
* Display error if no [...nextauth].js found
fixes#647
* Log the error and describe it inside errors.md
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* chore(deps): Bump ini from 1.3.5 to 1.3.8 in /www (#953)
Bumps [ini](https://github.com/isaacs/ini) from 1.3.5 to 1.3.8.
- [Release notes](https://github.com/isaacs/ini/releases)
- [Commits](https://github.com/isaacs/ini/compare/v1.3.5...v1.3.8)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs: fix typo Adapater -> Adapter (#960)
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Vladimir Evdokimov <evdokimov.vladimir@gmail.com>
* docs: We have twice the word "side" (#964)
* chore: use stale label, instead of wontfix
* chore: add link to issue explaining stalebot
* chore: fix typo in stalebot comment
* chore: run build GitHub Action on canary also
* chore: run build GitHub Actions on canary as well
* chore: add reproduction section to questions
* feat(provider): Add Azure Active Directory B2C (#809)
* add provider: Microsoft
* documentation
* support no tenant setup
* fix code style
* chore: rename Microsoft provider to AzureADB2C
* chore: alphabetical order in providers/index
* Revert "feat(provider): Add Azure Active Directory B2C (#809)" (#919)
This reverts commit 6e6a24a7af.
* chore: add myself to the contributors list 🙈
* We have twice the word "side"
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Vladimir Evdokimov <evdokimov.vladimir@gmail.com>
* docs: Correcting a typo. "available" Line 70 (#965)
* chore: use stale label, instead of wontfix
* chore: add link to issue explaining stalebot
* chore: fix typo in stalebot comment
* chore: run build GitHub Action on canary also
* chore: run build GitHub Actions on canary as well
* chore: add reproduction section to questions
* feat(provider): Add Azure Active Directory B2C (#809)
* add provider: Microsoft
* documentation
* support no tenant setup
* fix code style
* chore: rename Microsoft provider to AzureADB2C
* chore: alphabetical order in providers/index
* Revert "feat(provider): Add Azure Active Directory B2C (#809)" (#919)
This reverts commit 6e6a24a7af.
* chore: add myself to the contributors list 🙈
* Correcting a typo. "available" Line 70
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Vladimir Evdokimov <evdokimov.vladimir@gmail.com>
* chore: hide comments from pull request template
* Update README.md
Updated the readme to include the projects logo, fixed some typos, and added license info and contributor image.
* feat: add strava provider (#986)
* Add Strava as a provider
* Add documentation for Strava provider
* Fix lint errors
Co-authored-by: Paul Kenneth Kent <paul@ventureharbour.com>
* Update README.md
* Update README.md
* feat: add semantic-release (#920)
* chore(release): change semantic-release/git to semantic-release/github
* docs(database): add mssql indexes in docs, fix typos (#925)
* added mssql indexes in docs, fixed typo
* docs: fix typo in www/docs/schemas/mssql.md
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* chore(release): delete old workflow
* chore(release): trigger release on docs type
* fix: treat user.id as optional param (#1010)
* fix(adapter): use findOne for typeorm (#1014)
* Change image to text from varchar (#777)
Co-authored-by: Nico Domino <yo@ndo.dev>
* feat(db): make Fauna DB collections & indexes configurable (#968)
* Add collections & indexes overrides for Fauna DB
* Fix the name of the verification token index
Co-authored-by: Florian Michaut <florian@coding-days.com>
* docs: Remove unnecessary promises (#915)
* feat: allow to return string in signIn callback (#1019)
* docs: small update to sign in/out examples (#1016)
* Update examples in client.md
* Update more examples
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* docs: update contributing information [skip release] (#1011)
* docs: update CONTRIBUTING.md
* docs: use db instead of database for more space
* docs: update CONTRIBUTING.md
* docs: update PR template
* docs: add note about skipping a release
* docs: fix typos in CONTRIBUTING.md [skip release]
* refactor: code base improvements (#959)
* chore: fix casing of OAuth
* refacotr: simplify default callbacks lib file
* refactor: use native URL instead of string concats
* refactor: move redirect to res.redirect, done to res.end
* refactor: move options to req
* refactor: improve IntelliSense, name all functions
* fix(lint): fix lint errors
* refactor: remove jwt-decode dependency
* refactor: refactor some callbacks to Promises
* revert: "refactor: use native URL instead of string concats"
Refs: 690c55b04089e4f3157424c816d43ee4cecb77a0
* chore: misc changes
Co-authored-by: Balazs Orban <balazs@nhi.no>
* feat(provider): Add Mail.ru OAuth Service Provider and Callback snippet (#522)
* Update callback.js
- Fix Mail.ru bug (missing request parameter: access_token)
Note: setGetAccessTokenProfileUrl should be added to Mail.ru provider to enable support.
* Add Mail.ru OAuth Service Provider
* Update callbacks.md
- Fix broken callbacks snippet.
* Update callback.js
- Bug fix https://github.com/nextauthjs/next-auth/pull/522#issuecomment-669851914
- Minor refactoring.
* Fix: Code linting.
* Update callback.js
Improve approach for building of URL based review recommendation.
* Feat: Reduce API surface expansion
Make use of provider.id === "mailru" as suggested in review discussion in place of setGetAccessTokenProfileUrl.
* Fix: Code linting
* feat: forward id_token to jwt and signIn callbacks (#1024)
* chore: add auto labeling to PRs [skip release] (#1025)
* chore: add auto labeling to PRs [skip release]
* chore: allow any file type for test label to be added
* chore: rename labeler.yaml to labeler.yml [skip release]
* fix: miscellaneous bugfixes (#1030)
* fix: use named params to fix order
* fix: avoid recursive redirects
* fix: revert to use parsed baseUrl
* fix: avoid recursive res.end calls
* fix: use named params in renderPage
* fix: promisify lib/oauth/callback result
* fix: don't chain on res.end on non-chainable res methods (#1031)
* docs: add powered by vercel logo [skip release]
* chore: run tests on canary [skip release]
* docs: misc improvements [skip release] (#1043)
* refactor: code base improvements 2 (#1045)
* fix: trigger release
* fix: use authorizationUrl correctly
* feat(provider): reduce user facing API (#1023)
Co-authored-by: Balazs Orban <balazs@nhi.no>
* fix: remove async from NextAuth default handler
This function should not return a Promise
* feat(provider): add vk.com provider (#1060)
* feat(provider): add vk.com provider
* refactor(provider): reduce vk.com provider api
* refactor: code base improvements 3 (#1072)
* refactor: extend res.{end,send,json}, redirect
* refactor: chain res methods, remove unnecessary ones
* refactor: simplify oauth callback signature
* refactor: code simplifications
* refactor: re-export everything from routes in one
* refactor: split up main index.js to multiple files
* refactor: simplify passing of provider(s) around
* refactor: extend req with callbackUrl inline
* refactor: simplify page rendering
* refactor: move error page redirects to main file, simplify renderer
* refactor: inline req.options definition
* refactor: simplify error fallbacks
* refactor: remove else branches and unnecessary try..catch
* refactor: add docs, and simplify jwt functions
* refactor: prefer errors object over switch..case in signin page
* feat: log all params sent to logger instead of only first
* refactor: fewer lines input validation
* refactor: remove even more unnecessary else branches
* feat: improve package development experience (#1064)
* chore(deps): add next and react to dev dependencies
* chore: move build configs to avoid crash with next dev
* chore: add next js dev app
* chore: remove .txt extension from LICENSE file
* chore: update CONTRIBUTING.md
* chore: watch css under development
* style(lint): run linter on index.css
* chore: fix some imports for dev server
* refactor: simplify client code
* chore: mention VSCode extension for linting
* docs: reword CONTRIBUTING.md
* chore: ignore linting pages and components
* fix: pass csrfToken to signin renderer
* feat: replace blur/focus event to visibility API for getSession (#1081)
* docs: clarify .env usage in CONTRIBUTING.md [skip release] (#1085)
* docs: improve FAQ docs [skip release]
* chore: update caiuse-lite db
* docs: update some urls in the docs [skip release]
* feat(pages): add dark theme support (#1088)
* feat(pages): add dark theme support
* docs: document theme option
* chore: remove ts-check from dev app
* style(pages): fix some text colors in dark mode
* feat(provider): add LINE provider (#1091)
* refactor: be explicit about path in jsonconfig [skip release]
* refactor: show signin page in dev app [skip release]
* fix: export getSession [skip release]
somehow the default export does not work in the dev app
* style: make p system theme aware [skip release]
* feat(provider): finish Reddit provider and add documentation (#1094)
* Create reddit.md
* uncommented profile callback
* Update reddit.md
* fix lint issues
* added reddit provider
* added reddit provider
* Add Reddit Provider
For some reason a bunch of providers got deleted in the last commit
* Add Reddit Provider
* Add Reddit Provider
* chore: define providers in single file for docs [skip release]
* chore: Comply to Vercel Open Source sponsorship [skip release] (#1087)
* added banner
* Changed banner image allignment
* changed location of banner again
* added to acknowledgement
* added to acknowledgement 1
* changed image size
* k
* l
* s
* s
* .
* added link to the banner in readme.md
* fixed image redirect
* fixed image allignment
* made changes in readme and index.js
* Changed the source of the banner image
* added banner to the footer of the site
* chore: fix lint issues [skip release]
* feat: add native hkdf (#1124)
* feat: add native hkdf
* feat: import only needed to do hkdf
* feat: tweak digest and arguments
* chore(deps): upgrade typeorm to v0.2.30 (#1145)
* docs: remove v1 documentation (#1142)
* chore(adapters): remove fauna (#1148)
* feat: forward signIn auth params to /authorize (#1149)
* refactor: authorisation -> authorization
* feat: forward authorizationParams from signIn function
* refactor: take auth params as third argument
* docs: document signIn authorizationParams
* fix(adapter): fix ISO Datetime type error in Prisma updateSession (#640)
Co-authored-by: Nico Domino <yo@ndo.dev>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* feat(provider): add option to generate email verification token (#541)
* Add option to generate email verification token
* chore: remove unused import
* refactor: define default generateVerificationToken in-place
* refactor: define default generateVerificationToken in-place
Co-authored-by: Nico Domino <yo@ndo.dev>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* docs: update info about TypeScript [skip release]
* feat: add PKCE support (#941)
* chore(deps): upgrade dependencies
* chore(deps): add pkce-challenge
* feat(pkce): initial implementation of PCKE support
* chore: remove URLSearchParams
* chore(deps): upgrade lockfile
* refactor: store code_verifier in a cookie
* refactor: add pkce handlers
* docs: add PKCE documentation
* chore: remove unused param
* chore: revert unnecessary code change
* fix: correct variable names
* fix: correct logger import
* feat(provider): add Salesforce provider (#1027)
* docs(provider): add Salesforce provider
* fix(provider): use authed_user on slack instead of spotify (#1174)
* fix: use startsWith for protocol matching in parseUrl
closes#842
* fix: fix lint issues
* docs: clear things up around using access_token [skip release]
#1078
* docs: fix typo in callbacks.md [skip release]
* chore(provider): remove Mixer (#1178)
"Thank you to our amazing community and Partners.
As of July 22, the Mixer service has closed."
* feat(provider): re-add state, expand protection provider options (#1184)
* refactor: move OAuthCallbackError to errors file
* refactor: improve pkce handling
* feat(provider): re-introduce state to provider options
* docs(provider): mention protection options "state" and "none"
* docs(provider): document state property deprecation
* fix: only add code_verifier param if protection is pkce
* docs: explain state deprecation better
* chore: unify string
* fix: send /authorize params through url
* fix: Add a null check to the window 'storage' event listener (#1198)
* Add a null check to the window 'storage' event listener
While testing in Cypress it's possible to receive a null value on Storage Events when 'clear' is called and will cause errors as seen in #1125.
* Update index.js
typo
* Update src/client/index.js
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* formatting
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* docs(provider): fix typos in providers code snippets [skip release] (#1204)
* docs(adapter): add adapter repo to documentation [skip release] (#1173)
* docs(adapter): add adapter repo to documentation
* docs(adapter): elaborate on custom repo
* fix: forward second argument to fetch body in signIn
fixes#1206
* docs: Fix grammar in "Feature Requests" section of FAQs [skip release] (#1212)
* refactor: provide raw idToken through account object (#1211)
* refactor: provide raw idToken through account object
* docs: clear up accessToken naming
* refactor: provide raw token response to account
* chore: fix grammar in comments
* feat: send all params to logger function (#1214)
* feat(provider): Add Medium (#1213)
* fix: leave accessTokenExpires as null
Forwarding expires_in as is to accessTokenExpires has shown to cause issues with Prisma, and maybe with other flows as well. Setting it back to `null` for now. We still forward `expires_in`, so users can use it if they want to.
Fixes#1216
* docs: more emphasis on req methods [skip release]
* docs: remove announcement bar [skip release]
* fix: make OAuth 1 work after refactoring (#1218)
* chore: add twitter provider to dev app
* feat: bind client instance to overriden methods
* fix: don't add extra params to getOAuthRequestToken
* chore: add twitter to env example, add secret gen instructions
* docs: Update Providers.Credential Example Block [skip release] (#1225)
Closing curly bracket where it should have been a square bracket.
* feat(provider): option to disable client-side redirects (credentials) (#1219)
* chore: add credentials provider to dev app
* feat: add redirect option to signIn, signOut
* feat: set correct status codes for credentials errors
* chore: add credentials page to dev app
* fix: support any provider name for credentials
* feat(ts): preliminary TypeScript support (#1223)
* chore: replace standard with ts-standard
* feat(ts): add some initial types
* feat(ts): import and use types
* chore: allow global fetch through package.json
* chore: upgrade lint scripts to use ts-standard
* chore: run linter on dev app
* chore(ts): satisfy dev Next.js server for TS
* fix: add eslint as dev dependency
* fix(lint): ignore next-env.d.ts from linting
* feat(ts): improve cookies options types
* fix: run linter with fix
* feat(provider): add EVE Online provider (#1227)
* Adding EVEOnline provider
* Adding EVEOnline provider
* Adding EVEOnline provider
* Adding EVEOnline provider
* Adding EVEOnline provider
* Adding EVEOnline provider
* Adding EVEOnline provider
* Adding EVEOnline provider
Co-authored-by: Gerald McNicholl <gerald.mcnicholl@xero.com>
* docs: clarify custom pages usage [skip release] (#1239)
* docs(provider): Update Atlassian docs (#1255)
* docs: Update Atlassian docs [skip release]
* Update atlassian.md
* fix(provider): okta client authentication (#1257)
* fix: okta client authentication
* chore: run lint fix
* Update pages/api/auth/[...nextauth].js
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: mgraser <matt.graser@mlb.com>
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* chore: don't sync labels with labeler [skip release]
manually added PR labels were constantly removed on new commits/builds, this hopefully fixes that
* fix(provider): add verificationRequest flag to email signIn callback (#1258)
* fix(ui): use color text var for input color (#1260)
Co-authored-by: Archit Khode <archit.khode@gmail.com>
* docs: Minor text error fixed [skip release] (#1263)
* feat(provider): update session when signIn/signOut successful (#1267)
* feat(provider): update session when login/logout successful
* chore: remove manual page reload from dev app
* docs(client): document redirect: false
* fix(page): fix typo in error page
* Merge pull request from GHSA-pg53-56cg-4m8q
* fix(adapter): Verify identifier as well as token in Prisma adapter
* feat(adapter): Improve typeorm adapter
Improve conditional check in TypeORM adapter.
This should have no impact in practice but sets a good example.
* docs(adapter): Update Prisma docs [skip release] (#1279) (#1283)
Co-authored-by: Iain Collins <me@iaincollins.com>
* docs(provider): Update azure-ad-b2c.md [skip release] (#1280)
* docs(adapter): Update Prisma docs (#1279)
* Update azure-ad-b2c.md
add hint for redirection URL, otherwise difficult to find out
* Update azure-ad-b2c.md
changed .env ro .env.local as per recommendation
* Update azure-ad-b2c.md
* Update azure-ad-b2c.md
* Update azure-ad-b2c.md
* update conf in .env.local
follow the .env guidelines
* Update azure-ad-b2c.md
* Create azure-ad-b2c.md
* Create azure-ad-b2c.md
* Update azure-ad-b2c.md
Co-authored-by: Iain Collins <me@iaincollins.com>
* docs: Change "docs" to "documentation"
* fix(provider): Fixes for email sign in (#1285)
* fix(adapter): Fix Prisma delete
Must use Prsima deleteMany() instead of delete() with multiple clauses.
* feat: Update example project
Update example project to make it easier to test with database adapters.
* fix(ui): Fix message text in light / auto theme
Info message text is always on the same background (blue) on both themes so should always be white.
* docs: Update example .env [skip release]
* feat: Update Prisma peerOptionalDependencies
* docs: trigger release
Co-authored-by: Luke Lau <luke_lau@icloud.com>
Co-authored-by: James Perkins <jamesperkins@hey.com>
Co-authored-by: Joshua K. Martinez <joshkmartinez@gmail.com>
Co-authored-by: Pauldic <Pauldiconline@yahoo.com>
Co-authored-by: Josh Padnick <josh@gruntwork.io>
Co-authored-by: Daggy1234 <arnav.jindal7@gmail.com>
Co-authored-by: Alan Ray <71240883+ohheyalanray@users.noreply.github.com>
Co-authored-by: Manish Chiniwalar <manishrc@users.noreply.github.com>
Co-authored-by: Aymeric <34040599+afoyer@users.noreply.github.com>
Co-authored-by: Nico Domino <yo@ndo.dev>
Co-authored-by: Fabrizio Ruggeri <ramiel@users.noreply.github.com>
Co-authored-by: Iain Collins <me@iaincollins.com>
Co-authored-by: Joseph Vaughan <Joev-@users.noreply.github.com>
Co-authored-by: Joost Jansky <styxlab@users.noreply.github.com>
Co-authored-by: styxlab <cws@DE01WP777.scdom.net>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: RobertCraigie <robertcraigie30@gmail.com>
Co-authored-by: Joe Bell <joe@joebell.co.uk>
Co-authored-by: Vladimir Evdokimov <evdokimov.vladimir@gmail.com>
Co-authored-by: Cathy Chen <cathykaichen@gmail.com>
Co-authored-by: Kristóf Poduszló <kripod@protonmail.com>
Co-authored-by: Haldun Anil <haldunanil@users.noreply.github.com>
Co-authored-by: Jakub Naskręski <36169811+kleyu@users.noreply.github.com>
Co-authored-by: imgregduh <imgregorywong@gmail.com>
Co-authored-by: pkabore <paulkabore333@gmail.com>
Co-authored-by: Paul Kenneth Kent <pkennethkent@gmail.com>
Co-authored-by: Paul Kenneth Kent <paul@ventureharbour.com>
Co-authored-by: Balazs Orban <balazs@nhi.no>
Co-authored-by: Junior Vidotti <jrvidotti@gmail.com>
Co-authored-by: Yuma Matsune <yuma.matsune@gmail.com>
Co-authored-by: Ben West <Xodarap@users.noreply.github.com>
Co-authored-by: Florian Michaut <florianmichaut@gmail.com>
Co-authored-by: Florian Michaut <florian@coding-days.com>
Co-authored-by: Melanie Seltzer <melleh11@gmail.com>
Co-authored-by: Didi Keke <nyedidikeke@users.noreply.github.com>
Co-authored-by: Evgeniy Boreyko <boreykojenya@yandex.ru>
Co-authored-by: Alex B <lnikell@gmail.com>
Co-authored-by: Ben <5271788+bebax@users.noreply.github.com>
Co-authored-by: suraj10k <63460026+suraj10k@users.noreply.github.com>
Co-authored-by: t.kuriyama <koolii0909@gmail.com>
Co-authored-by: Yuri Gor <YuriGor@users.noreply.github.com>
Co-authored-by: Radhika <56536997+96RadhikaJadhav@users.noreply.github.com>
Co-authored-by: Henrik Wenz <HaNdTriX@users.noreply.github.com>
Co-authored-by: Zhao Lei <firede@firede.com>
Co-authored-by: Mohamed El Mahallawy <mmahalwy@gmail.com>
Co-authored-by: Dillon Mulroy <dillon.mulroy@gmail.com>
Co-authored-by: Carmelo Scandaliato <8927157+cascandaliato@users.noreply.github.com>
Co-authored-by: Aishah <aissshah@outlook.com>
Co-authored-by: Samson Zhang <wwsamson@yahoo.com>
Co-authored-by: Vova <volodimir.partytskyi@gmail.com>
Co-authored-by: Cody Ogden <cody@codyogden.com>
Co-authored-by: geraldm74 <gerald_mcnicholl@yahoo.com>
Co-authored-by: Gerald McNicholl <gerald.mcnicholl@xero.com>
Co-authored-by: Jeremy Caine <jezcaine@gmail.com>
Co-authored-by: Matthew Graser <mdgraser@gmail.com>
Co-authored-by: mgraser <matt.graser@mlb.com>
Co-authored-by: Kristofor Carle <kris@maphubs.com>
Co-authored-by: Archit Khode <arkits@outlook.com>
Co-authored-by: Archit Khode <archit.khode@gmail.com>
Co-authored-by: Daniel Gadd <danielgadd@outlook.com>
Co-authored-by: Robert Hufsky <Robert.Hufsky@gmx.net>
* chore: add twitter provider to dev app
* feat: bind client instance to overriden methods
* fix: don't add extra params to getOAuthRequestToken
* chore: add twitter to env example, add secret gen instructions
Forwarding expires_in as is to accessTokenExpires has shown to cause issues with Prisma, and maybe with other flows as well. Setting it back to `null` for now. We still forward `expires_in`, so users can use it if they want to.
Fixes#1216
* refactor: provide raw idToken through account object
* docs: clear up accessToken naming
* refactor: provide raw token response to account
* chore: fix grammar in comments
* Add a null check to the window 'storage' event listener
While testing in Cypress it's possible to receive a null value on Storage Events when 'clear' is called and will cause errors as seen in #1125.
* Update index.js
typo
* Update src/client/index.js
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* formatting
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* refactor: authorisation -> authorization
* feat: forward authorizationParams from signIn function
* refactor: take auth params as third argument
* docs: document signIn authorizationParams
* added banner
* Changed banner image allignment
* changed location of banner again
* added to acknowledgement
* added to acknowledgement 1
* changed image size
* k
* l
* s
* s
* .
* added link to the banner in readme.md
* fixed image redirect
* fixed image allignment
* made changes in readme and index.js
* Changed the source of the banner image
* added banner to the footer of the site
* feat(pages): add dark theme support
* docs: document theme option
* chore: remove ts-check from dev app
* style(pages): fix some text colors in dark mode
* chore(deps): add next and react to dev dependencies
* chore: move build configs to avoid crash with next dev
* chore: add next js dev app
* chore: remove .txt extension from LICENSE file
* chore: update CONTRIBUTING.md
* chore: watch css under development
* style(lint): run linter on index.css
* chore: fix some imports for dev server
* refactor: simplify client code
* chore: mention VSCode extension for linting
* docs: reword CONTRIBUTING.md
* chore: ignore linting pages and components
* fix: use named params to fix order
* fix: avoid recursive redirects
* fix: revert to use parsed baseUrl
* fix: avoid recursive res.end calls
* fix: use named params in renderPage
* fix: promisify lib/oauth/callback result
* Update callback.js
- Fix Mail.ru bug (missing request parameter: access_token)
Note: setGetAccessTokenProfileUrl should be added to Mail.ru provider to enable support.
* Add Mail.ru OAuth Service Provider
* Update callbacks.md
- Fix broken callbacks snippet.
* Update callback.js
- Bug fix https://github.com/nextauthjs/next-auth/pull/522#issuecomment-669851914
- Minor refactoring.
* Fix: Code linting.
* Update callback.js
Improve approach for building of URL based review recommendation.
* Feat: Reduce API surface expansion
Make use of provider.id === "mailru" as suggested in review discussion in place of setGetAccessTokenProfileUrl.
* Fix: Code linting
* docs: update CONTRIBUTING.md
* docs: use db instead of database for more space
* docs: update CONTRIBUTING.md
* docs: update PR template
* docs: add note about skipping a release
* Add collections & indexes overrides for Fauna DB
* Fix the name of the verification token index
Co-authored-by: Florian Michaut <florian@coding-days.com>
* chore: use stale label, instead of wontfix
* chore: add link to issue explaining stalebot
* chore: fix typo in stalebot comment
* chore: run build GitHub Action on canary also
* chore: run build GitHub Actions on canary as well
* chore: add reproduction section to questions
* feat(provider): Add Azure Active Directory B2C (#809)
* add provider: Microsoft
* documentation
* support no tenant setup
* fix code style
* chore: rename Microsoft provider to AzureADB2C
* chore: alphabetical order in providers/index
* Revert "feat(provider): Add Azure Active Directory B2C (#809)" (#919)
This reverts commit 6e6a24a7af.
* chore: add myself to the contributors list 🙈
* Correcting a typo. "available" Line 70
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Vladimir Evdokimov <evdokimov.vladimir@gmail.com>
* chore: use stale label, instead of wontfix
* chore: add link to issue explaining stalebot
* chore: fix typo in stalebot comment
* chore: run build GitHub Action on canary also
* chore: run build GitHub Actions on canary as well
* chore: add reproduction section to questions
* feat(provider): Add Azure Active Directory B2C (#809)
* add provider: Microsoft
* documentation
* support no tenant setup
* fix code style
* chore: rename Microsoft provider to AzureADB2C
* chore: alphabetical order in providers/index
* Revert "feat(provider): Add Azure Active Directory B2C (#809)" (#919)
This reverts commit 6e6a24a7af.
* chore: add myself to the contributors list 🙈
* We have twice the word "side"
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Vladimir Evdokimov <evdokimov.vladimir@gmail.com>
* Display error if no [...nextauth].js found
fixes#647
* Log the error and describe it inside errors.md
Co-authored-by: Balázs Orbán <info@balazsorban.com>
* chore: use stale label, instead of wontfix
* chore: add link to issue explaining stalebot
* chore: fix typo in stalebot comment
* chore: run build GitHub Action on canary also
* chore: run build GitHub Actions on canary as well
* chore: add reproduction section to questions
* feat(provider): Add Azure Active Directory B2C (#809)
* add provider: Microsoft
* documentation
* support no tenant setup
* fix code style
* chore: rename Microsoft provider to AzureADB2C
* chore: alphabetical order in providers/index
* Revert "feat(provider): Add Azure Active Directory B2C (#809)" (#919)
This reverts commit 6e6a24a7af.
* chore: add myself to the contributors list 🙈
* docs: fix incorrect references in cypress docs
* chore: add additional docs clarification
Co-authored-by: Balázs Orbán <info@balazsorban.com>
Co-authored-by: Vladimir Evdokimov <evdokimov.vladimir@gmail.com>
* add provider: Microsoft
* documentation
* support no tenant setup
* fix code style
* chore: rename Microsoft provider to AzureADB2C
* chore: alphabetical order in providers/index
* doc: add provider to FAQ
the current routing for the Okta provider does not follow the standard
set by Okta, and as such doesn't allow for custom subdomains. this
update amends the routes to allow for customer subdomains, and also
aligns next-auth with Okta's documentation.
* add provider: Microsoft
* documentation
* support no tenant setup
* fix code style
* chore: rename Microsoft provider to AzureADB2C
* chore: alphabetical order in providers/index
* Centralises configuration for Puppeteer used in tests to make it easier to maintain.
* Adds support for running tests on ARM, so we can use Raspberry Pi test runners off the cloud to get around block lists.
* Includes improved stealth mode to avoid detection which breaks integration tests.
Full end-to-end integration tests for Twitter (OAuth 1) and GitHub (OAuth 2) using Puppeteer and Mocha.
This replaces Cypress tests due to issues with Cypress not being able to run tests against external URLs, which we need for our integration tests.
The integration test runner is hosted outside of GitHub Actions (it cannot be hosted by GitHub or on AWS due to IP access controls placed on sign in by providers like Twitter and GitHub) and so the integration tests may not pass if the test runner is offline. If this happens, tests can be re-run later when the test runner is available.
See Pull Request #641 for details.
Adds commands to start/rebuild/stop a Docker image of a sample Next.js app that loads the latest build of NextAuth.js from the current directory.
* `npm run test:app:start`
* `npm run test:app:rebuild`
* `npm run test:app:stop`
It is intended for further development for automated testing.
### About the build process
* The Dockerfile uses a multi-stage build process to optimise build performance, but the nature of the process is slow.
* Build times vary depending on computer speed and internet connection.
* Inital build times are slow (it may take 10 minutes or more).
* Subsequent builds on the same computer should be faster (1 minute or less).
* To ensure the package.json is valid, modules required in the next-auth package.json file are re-downloaded* on every build.
* A Docker compose file is used to allow us to extend the test app to run it again multiple databases.
Subsequent updates may look to improve performance, but it's important checks like checking package.json is valid and running the build in isolation are performed.
* Add cypress, testing-library/cypress and server dev helper to package dev dependencies
* Add initial signin test and placeholder cypress files
* Add initial signout tests
* Add initial verify-request test
* Move page-only tests into a 'pages' directory
* Add an invalid email signup workflow test
* Use home-page sign in button for email workflow
* Some tests to check that clicking the button takes the user to the correct OAuth page (warning: fragile!)
* Add a couple of npm scripts to make it easier to run/ developer e2e tests
Co-authored-by: Iain Collins <me@iaincollins.com>
Discord is migrating to discord.com, including their OAuth2 API routes. Support for the old domain, discordapp.com, will be dropped on 7 Nov 2020.
Note that the cdn.discordapp.com domain is unchanged. This is intentional, as the cdn domain will not be migrated due to technical restraints on Discord's side.
I was getting this error due to it being a string value.
```sh
[next-auth][error][jwt_session_error] JWTClaimInvalid: "auth_time" claim must be a JSON numeric value
at isTimestamp (/Users/alex/code/trufans/node_modules/jose/lib/jwt/verify.js:24:11)
at validateTypes (/Users/alex/code/trufans/node_modules/jose/lib/jwt/verify.js:159:3)
at Object.module.exports [as verify] (/Users/alex/code/trufans/node_modules/jose/lib/jwt/verify.js:236:3)
at Object.<anonymous> (/Users/alex/code/trufans/node_modules/next-auth/dist/lib/jwt.js:100:30)
at Generator.next (<anonymous>)
at asyncGeneratorStep (/Users/alex/code/trufans/node_modules/next-auth/dist/lib/jwt.js:22:103)
at _next (/Users/alex/code/trufans/node_modules/next-auth/dist/lib/jwt.js:24:194)
at /Users/alex/code/trufans/node_modules/next-auth/dist/lib/jwt.js:24:364
at new Promise (<anonymous>)
at Object.<anonymous> (/Users/alex/code/trufans/node_modules/next-auth/dist/lib/jwt.js:24:97) {
code: 'ERR_JWT_CLAIM_INVALID',
claim: 'auth_time',
reason: 'invalid'
}
```
Currently the Google Provider example will always fail due to checking for `email_verified` when the correct response from the server is `verified_email`
next-auth debug output for validation:
```
[next-auth][debug][profile_data] {
id: 'XXXXXXX',
email: 'nick@example',
verified_email: true,
name: 'Nick Parks',
given_name: 'Nick',
family_name: 'XXXX',
picture: 'XXXX,
locale: 'en',
hd: 'example.com'
}
```
This isn't technically required (it is working fine currently) but if we specify the type explicitly it should help avoid any problems in future that might be introduced with refactoring.
* CSS Refactor to make it easier to maintain and UI more consistant.
* Misc small updates to docs
* Split off tutorials into a seperate menu item
I would like to add more tutorials and explainers, including those people have written on other sites.
This is a starting point for that.
An issue with the defaults for MySQL used by TypeORM Adapter has been highlighted during testing parity with the Prisma Adapter.
This change ensures *all* TIMESTAMP columns use TIMESTAMP(6) to store six digits of precision after the number of seconds.
While this is level of precision is not required everywhere it ensures all timestamps in the default models use the same configuration (instead of a mix of values) and is consisitant with the level of precision on timestamps used Postgres.
This doesn't technically do anything (except for the mongodb peer dependancy, which is invoked when a mongodb is being used) but it provides a way for us to indicate and track the last known good versions of database clients for NextAuth.js.
* Uses `require_optional` and `peerOptionalDependencies` instead of dynamic import to resolve issue some users have experience with using using compliers/bundlers (especially on starter projects) that don't handle dynamic imports well.
This should (hopefully) also make it easier to support older versions of Internet Explorer by avoiding bundlers that choke on dynamic imports unless MongoDB is included as a dependancy (even though it's not code they need to compile).
We use `require_optional` to load `ObjectID` conditionally, if NextAuth.js is using MongoDB. This is also exactly how the MongoDB driver itself loads the ObjectID from the `bson/bson-ext` module.
Should resolve#251
* The default name for the TypeORM connection is now 'nextauth' instead of 'default'.
This should help people avoid problems with connection re-use when not using serverless (including in local development), especially if they are doing things with their default connection that differ from whats expected by NextAuth.js (like not using UTF-8 for encoding or UTC timezones).
* Now uses connection manager object from the connection, to allow a custom TypeORM connection name to be specified (resolves#459).
Working implementation (with limited key length and no exp check) using node-jose from Cisco.
I want to compare it panva/jose which has more features before building it out.
Now that we are going to expose the option to disable encryption on tokens we need to enforce the algorithm is valid (e.g. not 'None' or 'RSA') to prevent vultrabilties being exploited by tampering with the token.
Custom encode/decode routines can be specified if someone needs to use another algorithm.
It makes sense to change this behaviour now we have a tutorial and have been testing this functionality.
Docs are being updated to reflect this change.
* clientMaxAge now passive
* clientPollInterval added (works like old clientMaxAge)
* poll intervals uses timer (more efficent)
* updates state on window focus/blur
Includes breaking changes for v3 and updates to documentation.
If using the client, the only required change should be setting the NEXTAUTH_URL environment variable.
When using a provider that uses Token ID option (like Apple) a user hitting cancel with no longer cause the app to crash.
Users who do this will now be taken back to the sign in page.
This was already working for other providers that didn't use this option but wasn't supported for providers that did use it.
* Forgot to do this when I added them.
* May add a script to compress them on commit.
* Adding new binary blobs bloats repo over time, we can always purge old assets if it's a problem.
* The social card is slightly too bright to compensate for PNG gamma interpretation not being consistant between browsers (too bright in some looks better than too dark in others). Maybe it should be a JPEG.
* New email template
* New callback error handling
I anticipate adding more changes and a new beta before we release 2.2.0 but wanted to test these changes.
* Prevents links from being turned into hyperlinks by email clients
* Improve UI with a primary action button and better font sizing and spacing in the template
* Adds email address to body to clear indicate who they will be signing in as
While not exactly a bug in NextAuth.js it does resolve#331
Currently if a user hits a cancel button after selecting the option to sign in with an OAuth provider an error is displayed.
This error is only triggered in production.
This update refactors error handling so that in both dev and prod modes, the user is directed back to the sign in page.
Not all OAuth providers have a cancel button on their sign in page (e.g. Twitter does, Google doesn't).
The oAuthCallback has been slightly refactored to make debugging easier. It is still pretty horrible, but i don't want to do major refactoring of it until we have tests we trust in place.
The action to publish to NPM fails as it can't run the DB test yet so removing that.
Changing the test to run the linter instead so it does something (e.g. catch the worst syntax errors).
2020-06-24 02:13:02 +01:00
1172 changed files with 96729 additions and 32497 deletions
**NOTE:** Issues that are potentially security related should be reported to us by following the [Security guidelines](https://next-auth.js.org/security) rather than on GitHub.
Thanks for taking the time to fill out this issue after reading/searching through the [documentation](https://next-auth.js.org) first!
Is this your first time contributing? Check out this video: https://www.youtube.com/watch?v=cuoNzXFLitc
### Important :exclamation:
_Providing incorrect/insufficient information or skipping steps to reproduce the issue will result in closing the issue and/or converting to a discussion without further explanation._
If you have a generic question specific to your project, it is best asked in Discussions under the [Questions category](https://github.com/nextauthjs/next-auth/discussions/new?category=Questions)
# Let's wait with this until adoption in other frameworks.
# - type: dropdown
# attributes:
# label: Framework
# description: Which framework(s) is this issue related to?
# multiple: true
# options:
# - "Next.js"
# - "Other"
- type:textarea
attributes:
label:Environment
description:|
Run this command in your project's root folder and paste the result:
Alternatively, you can manually gather the version information from your package.json for these packages: "next", "react" and "next-auth". Please also mention your OS and Node.js version, as well as the browser you are using.
validations:
required:true
- type:input
attributes:
label:Reproduction URL
description:A URL to a repository/code that clearly reproduces your issue. You can use our [`next-auth-example`](https://github.com/nextauthjs/next-auth-example) template repository to get started more easily, or link to your project if it's public
validations:
required:true
- type:textarea
attributes:
label:Describe the issue
description:Describe us what the issue is and what have you tried so far to fix it. Add any extra useful information in this section. Feel free to use screenshots (but prefer [code blocks](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks#syntax-highlighting) over a picture of your code) or a video explanation.
validations:
required:true
- type:textarea
attributes:
label:How to reproduce
description:Explain with clear steps how to reproduce the issue
validations:
required:true
- type:textarea
attributes:
label:Expected behavior
description:Explain what should have happened instead of what actually happened
**NOTE:** Issues that are potentially security related should be reported to us by following the [Security guidelines](https://next-auth.js.org/security) rather than on GitHub.
Thanks for taking the time to fill out this [Provider](https://next-auth.js.org/providers/overview) related issue!
Is this your first time contributing? Check out this video: https://www.youtube.com/watch?v=cuoNzXFLitc
### Important :exclamation:
_Providing incorrect/insufficient information or skipping steps to reproduce the issue may result in closing the issue or converting to a discussion without further explanation._
If you have a generic question specific to your project, it is best asked in Discussions under the [Questions category](https://github.com/nextauthjs/next-auth/discussions/new?category=Questions)
- type:dropdown
attributes:
label:Provider type
description:Provider(s) this issue is related to
multiple:true
options:
- "Credentials"
- "Email"
- "Custom provider"
- "42 School"
- "Apple"
- "Asgardeo"
- "Atlassian"
- "Auth0"
- "Authentik"
- "Azure Active Directory"
- "Azure Active Directory B2C"
- "Azure DevOps"
- "Battlenet"
- "Beyond Identity"
- "Box"
- "Bungie"
- "ClickUp"
- "Cognito"
- "Coinbase"
- "Descope"
- "Discord"
- "Dribbble"
- "Dropbox"
- "EVE Online"
- "Facebook"
- "FACEIT"
- "Foursquare"
- "Freshbooks"
- "FusionAuth"
- "GitHub"
- "GitLab"
- "Google"
- "Identity Server 4"
- "Instagram"
- "Kakao"
- "Keycloak"
- "Line"
- "LinkedIn"
- "Mailchimp"
- "Mail.ru"
- "Mastodon"
- "Medium"
- "Naver"
- "Netlify"
- "Notion"
- "Okta"
- "OneLogin"
- "Osso"
- "Osu"
- "Patreon"
- "Pipedrive"
- "Reddit"
- "Salesforce"
- "Slack"
- "Spotify"
- "Strava"
- "Tiktok"
- "Todoist"
- "Trakt"
- "Twitch"
- "Twitter"
- "Vk"
- "Wordpress"
- "WorkOS"
- "Yandex"
- "Zoho"
- "Zoom"
validations:
required:true
- type:textarea
attributes:
label:Environment
description:|
Run this command in your project's root folder and paste the result:
Alternatively, you can manually gather the version information from your package.json for these packages: "next", "react" and "next-auth". Please also mention your OS and Node.js version, as well as the browser you are using.
validations:
required:true
- type:input
attributes:
label:Reproduction URL
description:A URL to a repository/code that clearly reproduces your issue. You can use our [`next-auth-example`](https://github.com/nextauthjs/next-auth-example) template repository to get started more easily, or link to your project if it's public
validations:
required:true
- type:textarea
attributes:
label:Describe the issue
description:Describe us what the issue is and what have you tried so far to fix it. Add any extra useful information in this section. Feel free to use screenshots (but prefer [code blocks](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks#syntax-highlighting) over a picture of your code) or a video explanation.
validations:
required:true
- type:textarea
attributes:
label:How to reproduce
description:Explain with clear steps how to reproduce the issue
validations:
required:true
- type:textarea
attributes:
label:Expected behavior
description:Explain what should have happened instead of what actually happened
**NOTE:** Issues that are potentially security related should be reported to us by following the [Security guidelines](https://next-auth.js.org/security) rather than on GitHub.
Thanks for taking the time to fill out this [Adapter](https://next-auth.js.org/adapters/overview) related issue!
Is this your first time contributing? Check out this video: https://www.youtube.com/watch?v=cuoNzXFLitc
### Important :exclamation:
_Providing incorrect/insufficient information or skipping steps to reproduce the issue may result in closing the issue or converting to a discussion without further explanation._
If you have a generic question specific to your project, it is best asked in Discussions under the [Questions category](https://github.com/nextauthjs/next-auth/discussions/new?category=Questions)
- type:dropdown
attributes:
label:Adapter type
description:Adapter(s) this issue is related to
multiple:true
options:
- "Custom adapter"
- "@auth/azure-tables-adapter"
- "@auth/edgedb-adapter"
- "@auth/d1-adapter"
- "@auth/dgraph-adapter"
- "@auth/drizzle-adapter"
- "@auth/dynamodb-adapter"
- "@auth/fauna-adapter"
- "@auth/firebase-adapter"
- "@auth/kysely-adapter"
- "@auth/mikro-orm-adapter"
- "@auth/mongodb-adapter"
- "@auth/neo4j-adapter"
- "@auth/pg-adapter"
- "@auth/pouchdb-adapter"
- "@auth/prisma-adapter"
- "@auth/sequelize-adapter"
- "@auth/supabase-adapter"
- "@auth/typeorm-adapter"
- "@auth/upstash-redis-adapter"
- "@auth/xata-adapter"
validations:
required:true
- type:textarea
attributes:
label:Environment
description:|
Run this command in your project's root folder and paste the result:
Alternatively, if the above command did not work, we need the version of the following packages from your package.json: "next", "react", "next-auth" and your adapter. Please also mention your OS and Node.js version, as well as the browser you are using.
validations:
required:true
- type:input
attributes:
label:Reproduction URL
description:A URL to a repository/code that clearly reproduces your issue. You can use our [`next-auth-example`](https://github.com/nextauthjs/next-auth-example) template repository to get started more easily, or link to your project if it's public
validations:
required:true
- type:textarea
attributes:
label:Describe the issue
description:Describe us what the issue is and what have you tried so far to fix it. Add any extra useful information in this section. Feel free to use screenshots (but prefer [code blocks](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks#syntax-highlighting) over a picture of your code) or a video explanation.
validations:
required:true
- type:textarea
attributes:
label:How to reproduce
description:Explain with clear steps how to reproduce the issue
validations:
required:true
- type:textarea
attributes:
label:Expected behavior
description:Explain what should have happened instead of what actually happened
A clear and concise description of what the defect is.
**To Reproduce**
Steps to reproduce the behavior.
Include example code (or link to public repository) which can be used to reproduce the behaviour.
**Expected behavior**
A clear and concise description of what you expected to happen.
**Screenshots or error logs**
If applicable, add screenshots or error logs to help explain the problem.
**Additional context**
Add any other context about the problem here.
**Documentation feedback**
*Documentation refers to searching through [online documentation](https://next-auth.js.org), code comments and issue history. The example project refers to [next-auth-example](https://github.com/iaincollins/next-auth-example).*
*Please stick to one distinct feature request per issue where possible and raise additional feature quests as separate issues. Try to avoid adding feature requests to existing issues in the comments of issues raised by other users.*
**Summary of proposed feature**
A clear and concise description of the feature being proposed.
**Purpose of proposed feature**
A clear and concise description description of why this feature is necessary and what problems it solves.
**Detail about proposed feature**
A detailed description of how the proposal might work (if you have one).
**Potential problems**
Describe any potential problems or potential limitations or caveats that might apply to the proposed solution.
**Describe any alternatives you've considered**
A clear and concise description of any alternative options you've considered.
**Additional context**
Any other context, screenshots, etc.
*Please indicate if you are willing and able to help implement the proposed feature.*
*Please refer to the [documentation](https://next-auth.js.org/getting-started/introduction), the [example project](https://github.com/iaincollins/next-auth-example) and existing issues before creating a new issue.*
**Your question**
A clear and concise question.
**What are you trying to do**
A description of what you are trying to do.
**Documentation feedback**
*Documentation refers to searching through [online documentation](https://next-auth.js.org), code comments and issue history. The example project refers to [next-auth-example](https://github.com/iaincollins/next-auth-example).*
Thanks for your interest in the project. Bugs filed and PRs submitted are appreciated!
Please fill out the information below to expedite the review and (hopefully)
merge of your pull request!
-->
> _NOTE_:
>
> - It's a good idea to open an issue first to discuss potential changes.
> - Please make sure that you are _NOT_ opening a PR to fix a potential security vulnerability. Instead, please follow the [Security guidelines](https://github.com/nextauthjs/.github/blob/main/SECURITY.md) to disclose the issue to us confidentially.
## ☕️ Reasoning
<!-- What changes are being made? What feature/bug is being fixed here? -->
## 🧢 Checklist
- [ ] Documentation
- [ ] Tests
- [ ] Ready to be merged
## 🎫 Affected issues
Please [scout and link issues](https://github.com/nextauthjs/next-auth/issues) that might be solved by this PR.
We could not detect a valid reproduction link. **Make sure to follow the bug report template carefully.**
### Why was this issue closed?
To be able to investigate, we need access to a reproduction to identify what triggered the issue. We need a link to a **public** GitHub repository. Example: ([NextAuth.js example repository](https://github.com/nextauthjs/next-auth-example)).
The bug template that you filled out has a section called "Reproduction URL", which is where you should provide the link to the reproduction.
- If you did not provide a link or the link you provided is not valid, we will close the issue.
- If you provide a link to a private repository, we will close the issue.
- If you provide a link to a repository but not in the correct section, we will close the issue.
### What should I do?
Depending on the reason the issue was closed, you can do the following:
- If you did not provide a link, please open a new issue with a link to a reproduction.
- If you provided a link to a private repository, please open a new issue with a link to a public repository.
- If you provided a link to a repository but not in the correct section, please open a new issue with a link to a reproduction in the correct section.
**In general, assume that we should not go through a lengthy onboarding process at your company code only to be able to verify an issue.**
### My repository is private and cannot make it public
In most cases, a private repo will not be a sufficient **minimal reproduction**, as this codebase might contain a lot of unrelated parts that would make our investigation take longer. Please do **not** make it public. Instead, create a new repository using the templates above, adding the relevant code to reproduce the issue. Common things to look out for:
- Remove any code that is not related to the issue. (pages, API Routes, components, etc.)
- Remove any dependencies that are not related to the issue.
- Remove any third-party service that would require us to sign up for an account to reproduce the issue.
- Remove any environment variables that are not related to the issue.
- Remove private packages that we do not have access to.
- If the issue is not related to a monorepo specifically, try to reproduce the issue without a complex monorepo setup
### I did not open this issue, but it is relevant to me, what can I do to help?
Anyone experiencing the same issue is welcome to provide a minimal reproduction following the above steps by opening a new issue.
### I think my reproduction is good enough, why aren't you looking into it quickly?
We look into every issue and monitor open issues for new comments.
However, sometimes we might miss a few due to the popularity/high traffic of the repository. We apologize, and kindly ask you to refrain from tagging core maintainers, as that will usually not result in increased priority.
Upvoting issues to show your interest will help us prioritize and address them as quickly as possible. That said, every issue is important to us, and if an issue gets closed by accident, we encourage you to open a new one linking to the old issue and we will look into it.
### Useful Resources
- [How to create a Minimal, Complete, and Verifiable example](https://stackoverflow.com/help/mcve)
Contributions and feedback on your experience of using this software are welcome.
This includes bug reports, feature requests, ideas, pull requests and examples of how you have used this software.
Please see the [Code of Conduct](CODE_OF_CONDUCT.md) and follow any templates configured in GitHub when reporting bugs, requesting enhancements or contributing code.
Please raise any significant new functionality or breaking change an issue for discussion before raising a Pull Request for it.
## Pull Requests
* The latest changes are always in `main`
* Pull Requests should be raised for larger changes
* Pull Requests do not need approval before merging for those with contributor access (it's just helpful to have them to track changes)
* Rebasing in Pull Requests is prefered to keep a clean commit history (see below)
* Running `npm run lint:fix` before committing can make resolving conflicts easier, but is not required
* Merge commits (and pushing merge commits to `main`) are disabled in this repo; but commits in PR can be squashed so this is not a blocker
* Pushing directly to main should ideally be reserved for minor updates (e.g. correcting typos) or small single-commit fixes
## Rebasing
*If you don't rebase and end up with merge commits in a PR then it's not a blocker, we can alway squash the commits when merging!*
If you create a branch and there are conflicting updates in the `main` branch, you can resolve them by rebasing from a check out of your branch:
git fetch
git rebase origin/main
If there are any conflicts, you can resolve them and stage the files, then run:
git rebase --continue
*If there are a lot of changes you may be prompted to step more than once.*
When the rebase is complete (i.e. there are no more conflicts) you should push your changes to your branch before doing anyhing else:
git push --force-with-lease
You should see that any conflicts in your PR are now resolved. You can review changes to make sure it contains changes you intended to make.
*If you accidentally sync before pushing, it will trigger a merge. Uou can use `git merge --abort` to undo the merge.*
You can use `npm run lint:fix` to automatically apply Standard JS rules to resolve formatting differences (tabs vs spaces, line endings, etc).
## Setting up local environment
A quick and dirty guide on how to setup *next-auth* locally to work on it and test out any changes:
3. Link React between the repo and the version installed in your project:
npm link ../your-application/node_modules/react
*This is an annoying step and not obvious, but is needed because of how React has been written (otherwise React crashes when you try to use the `useSession()` hook in your project).*
4. Finally link your project back to your local copy of next auth:
cd ../your-application
npm link ../next-auth
That's it!
Notes: You may need to repeat both `npm link` steps if you install / update additional dependancies with `npm i`.
If you need an example project to link to, you can use [next-auth-example](https://github.com/iaincollins/next-auth-example).
### Hot reloading
You might find it helpful to use the `npm run watch` command in the next-auth project, which will automatically (and silently) rebuild JS and CSS files as you edit them.
cd next-auth/
npm run watch
If you are working on `next-auth/src/client/index.js` hot reloading will work as normal in your Next.js app.
However if you are working on anything else (e.g. `next-auth/src/server/*` etc) then you will need to *stop and start* your app for changes to apply as **Next.js will not hot reload those changes**.
### Databases
Included is a Docker Compose file that starts up MySQL, Postgres and MongoDB databases on localhost.
It will use port 3306, 5432 and 27017 on localhost respectively; it will not work if are running existing databases on localhost.
You can start them with `npm run db:start` and stop them with `npm run db:stop`.
You will need Docker installed to be able to start / stop the databases.
When stop the databases, it will reset their contents.
### Testing
Tests can be run with `npm run test`.
Automated tests are currently crude and limited in functionality, but improvements are in development.
Currently to run tests you need to first have started local test databases (e.g. using `npm run db:start`).
The databases can take a few seconds to start up, so you might need to give it a minute before running the tests.
Auth.js is a set of open-source packages that are built on Web Standard APIs for authentication in modern applications with any framework on any platform in any JS runtime.
NextAuth.js is a complete open source authentication solution for [Next.js](http://nextjs.org/) applications.
It is designed from the ground up to support Next.js and Serverless.
[Follow the examples](https://next-auth.js.org/getting-started/example) to see how easy it is to use NextAuth.js for authentication.
Install: `npm i next-auth`
See [next-auth.js.org](https://next-auth.js.org) for more information and documentation.
See [authjs.dev](https://authjs.dev) for our framework-specific libraries, or check out [next-auth.js.org](https://next-auth.js.org) for `next-auth` (Next.js).
## Features
### Authentication
### Flexible and easy to use
* Designed to work with any OAuth service, it supports OAuth 1.0, 1.0A and 2.0
* Built-in support for [many popular OAuth sign-in services](https://next-auth.js.org/configuration/providers)
*Supports email / passwordless authentication
*Supports both JSON Web Tokens and database sessions
- Designed to work with any OAuth service, it supports 2.0+, OIDC
- Built-in support for [many popular sign-in services](https://github.com/nextauthjs/next-auth/tree/main/packages/core/src/providers)
-Email/Passwordless authentication
-Bring Your Database - or none! - stateless authentication with any backend (Active Directory, LDAP, etc.)
* An open source solution that allows you to keep control of your data
* Supports Bring Your Own Database (BYOD) and can be used with any database
*Built-in support for for [MySQL, MariaDB, Postgres, MongoDB and SQLite](https://next-auth.js.org/configuration/database)
*Works great with databases from popular hosting providers
*Can also be used without a database (e.g. OAuth + JWT)
Auth.js can be used with or without a database.
-An open-source solution that allows you to keep control of your data
-Built-in support for [MySQL, MariaDB, Postgres, Microsoft SQL Server, MongoDB, SQLite, etc.](https://adapters.authjs.dev)
-Works great with databases from popular hosting providers
### Secure by default
*Designed to be secure by default and promote best practice for safeguarding user data
*Attempts to implement the latest guidance published by [Open Web Application Security Project](https://owasp.org/)
-Promotes the use of passwordless sign-in mechanisms
-Designed to be secure by default and encourage best practices for safeguarding user data
- Uses Cross-Site Request Forgery (CSRF) Tokens on POST routes (sign in, sign out)
- Default cookie policy aims for the most restrictive policy appropriate for each cookie
- When JSON Web Tokens are used, they are encrypted by default (JWE) with A256GCM
- Features tab/window syncing and session polling to support short-lived sessions
- Attempts to implement the latest guidance published by [Open Web Application Security Project](https://owasp.org)
Security focused features include CSRF protection, use of signed cookies, cookie prefixes, secure cookies, HTTP only, host only and secure only cookies and promoting passwordless sign-in.
Advanced configuration allows you to define your routines to handle controlling what accounts are allowed to sign in, for encoding and decoding JSON Web Tokens and to set custom cookie security policies and session properties, so you can control who can sign in and how often sessions have to be re-validated.
## Example
### TypeScript
### Add API Route
Auth.js libraries are written with type safety in mind. [Check out the docs](https://authjs.dev/getting-started/typescript) for more information.
```javascript
importNextAuthfrom'next-auth'
importProvidersfrom'next-auth/providers'
## Security
constoptions={
site:'https://example.com'
providers:[
// OAuth authentication providers
Providers.Apple({
clientId:process.env.APPLE_ID,
clientSecret:process.env.APPLE_SECRET
}),
Providers.Google({
clientId:process.env.GOOGLE_ID,
clientSecret:process.env.GOOGLE_SECRET
}),
// Sign in with passwordless email link
Providers.Email({
server:process.env.MAIL_SERVER,
from:'<no-reply@example.com>'
}),
],
// SQL or MongoDB database (or leave empty)
database:process.env.DATABASE_URL
}
If you think you have found a vulnerability (or are not sure) in Auth.js or any of the related packages (i.e. Adapters), we ask you to read our [Security Policy](https://authjs.dev/security) to reach out responsibly. Please do not open Pull Requests/Issues/Discussions before consulting with us.
exportdefault(req,res)=>NextAuth(req,res,options)
```
## Acknowledgments
### Add React Component
[Auth.js is made possible thanks to all of its contributors.](https://authjs.dev/contributors)
If you'd like to contribute to you can find useful information in our [Contributing Guide](https://github.com/iaincollins/next-auth/blob/main/CONTRIBUTING.md).
We're open to all community contributions! If you'd like to contribute in any way, please first read
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
