chore(release): bump version [skip ci]

fix: reduce logger.error context
chore: gitignore v4 files
2026-05-01 10:55:20 +00:00 · 2022-07-25 12:31:40 +02:00 · 2022-07-25 11:14:49 +02:00 · 2022-07-25 11:13:44 +02:00 · 2022-07-05 13:49:23 +02:00 · 2022-07-05 13:47:28 +02:00
59 changed files with 6135 additions and 17588 deletions
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1,3 +1,4 @@
 # https://docs.github.com/en/github/administering-a-repository/displaying-a-sponsor-button-in-your-repository

+open_collective: nextauth
 github: [balazsorban44]
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,43 +0,0 @@
---
-name: Bug report
-about: Report a defect with NextAuth.js
-labels: bug
-assignees: ""
---
-
-## Description 🐜
-
-Please provide a clear and concise description of the bug in NextAuth.js.
-
-🚧 – _Do not report bugs with your own project here; ask for help [by raising a question instead](https://github.com/nextauthjs/next-auth/issues/new?assignees=&labels=question&template=question.md) - this helps us a lot with administration overhead._
-
-## How to reproduce ☕️
-
-We encourage you to use one of the templates set up on **CodeSandbox** to reproduce your issue:
-
- [`next-auth-example`](https://codesandbox.io/s/next-auth-example-1kktb)
- [`next-auth-typescript-example`](https://codesandbox.io/s/next-auth-typescript-example-se32w)
-
-🚧 – _If you don't provide any way to reproduce the bug, the issue is at risk of being closed._
-
-## Screenshots / Logs 📽
-
-**Help us help you**. We can address the bug you found much faster if you provide contextual screenshots or screen recordings showcasing the issue.
-
-See [Kap](https://getkap.co/) for a good, easy-to-use, cross-platform screen recording tool.
-
-## Environment 🖥
-
-Please run this command:
-
-```
-$ npx envinfo --system --binaries --browsers --npmPackages "{next-auth}"
-```
-
-and paste the output here.
-
-## Contributing 🙌🏽
-
-It takes a lot of work 🏋🏻‍♀️ maintaining a library like `next-auth`; any contribution is more than welcome 💚
-
-In case you're willing to help fix this bug, please let us know here, and we'll reach you 😊 . Otherwise, you can have a look at the issues labelled with [`"good first issue"`](https://github.com/nextauthjs/next-auth/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) and pick any of them.
--- a/.github/ISSUE_TEMPLATE/bug_report.yaml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yaml
@@ -0,0 +1,91 @@
+name: Bug Report
+description: File a bug report
+labels: bug
+
+# note: markdown sections will NOT appear as part of the issue as per documentation, rather they provide context to the user
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema#markdown
+
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report! Please provide the following information:
+  - type: textarea
+    id: description
+    attributes: 
+      label: Description 🐜
+      description: Please provide a clear and concise description of the bug in NextAuth.js
+    validations:
+      required: true  
+
+  - type: dropdown
+    id: ownproject
+    attributes: 
+      label: Is this a bug in your own project?
+      description: 🚧 – _Do not report bugs with your own project here; ask for help [by raising a question instead](https://github.com/nextauthjs/next-auth/issues/new?assignees=&labels=question&template=question.md) or use the [Discussions tab](https://github.com/nextauthjs/next-auth/discussions) - this helps us reduce the maintenance overhead._
+      multiple: false
+      options:
+        - "Yes"
+        - "No"
+    validations:
+      required: true
+      
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: How to reproduce ☕️ 
+      description: Please provide a link or code snippets to a minimal reproduction of the bug
+    validations:
+      required: true 
+  - type: markdown
+    attributes:
+      value: |
+        We encourage you to use one of the templates set up on **CodeSandbox** to reproduce your issue:
+        - [`next-auth-example`](https://codesandbox.io/s/next-auth-example-1kktb)
+        - [`next-auth-typescript-example`](https://codesandbox.io/s/next-auth-typescript-example-se32w)
+
+        🚧 – _If you don't provide any way to reproduce the bug, the issue is at risk of being closed._
+  
+  - type: textarea
+    id: logs
+    attributes: 
+      label: Screenshots / Logs 📽
+      description: We can address the bug you found much faster if you provide contextual screenshots or screen recordings showcasing the issue.
+  - type: markdown
+    attributes:
+      value: |
+        See [Kap](https://getkap.co/) for a good, easy-to-use, cross-platform screen recording tool.
+    validations:
+      required: false
+
+  - type: textarea
+    id: environment
+    attributes: 
+      label: Environment 🖥
+    validations:
+      required: true
+  - type: markdown
+    attributes:
+      value: |
+        Please run this command in your project's root folder:
+
+        ```sh
+        npx envinfo --system --binaries --browsers --npmPackages "next,next-auth,react"
+        ```
+ 
+  - type: dropdown
+    id: pr
+    attributes:
+      label: Contributing 🙌🏽
+      multiple: false
+      options:
+        - "Yes,  I am willing to help solve this bug in a PR"
+        - "No, I am afraid I cannot help regarding this"
+    validations:
+      required: true
+  - type: markdown
+    attributes: 
+      value: |
+        It takes a lot of work 🏋🏻‍♀️ maintaining a library like `next-auth`; any contribution is more than welcome 💚
+  
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -1,39 +0,0 @@
---
-name: Feature request
-about: Suggest an idea for NextAuth.js
-labels: enhancement
-assignees: ""
---
-
-## Summary 💭
-
-A clear and concise summary of the feature being proposed.
-
-## Description 📓
-
-Please provide a more in-depth description of the feature proposed.
-
-Make sure you provide plenty of [links]() to external documentation and inline code examples like so:
-
-```js
-function myAwesomeNextAuthFeature() {
-  return 💚
-}
-```
-
-Take time thinking about what you want to say and help us understand your proposal making sure that this description contains:
-
- **purpose of the feature**
- **potential problems**
- **potential alternatives**
-
-You can use one of the templates set up on **CodeSandbox** to better illustrate your idea:
-
- [`next-auth-example`](https://codesandbox.io/s/next-auth-example-1kktb)
- [`next-auth-typescript-example`](https://codesandbox.io/s/next-auth-typescript-example-se32w)
-
-## Contributing 🙌🏽
-
-It takes a lot of work 🏋🏻‍♀️ maintaining a library like `next-auth`; any contribution is more than welcome 💚
-
-In case you're willing to help implement this feature, please let us know here, and we'll reach you 😊 . Otherwise, you can have a look at the issues labelled with [`"good first issue"`](https://github.com/nextauthjs/next-auth/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) and pick any of them.
--- a/.github/ISSUE_TEMPLATE/feature_request.yaml
+++ b/.github/ISSUE_TEMPLATE/feature_request.yaml
@@ -0,0 +1,68 @@
+name: Feature Request
+description: Suggest an idea for NextAuth.js
+labels: enhancement
+
+# note: markdown sections will NOT appear as part of the issue as per documentation, rather they provide context to the user
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema#markdown
+
+body:
+  - type: markdown
+    attributes:
+      value: | 
+        Thank you very much for reaching out to us regarding the awesome feature that you believe should be included in the NextAuth.js library. Please provide the following information:
+ 
+  - type: textarea
+    id: description
+    attributes:
+      label: Description 📓
+      description: Please provide a more in-depth description of the feature proposed.
+    validations:
+      required: true
+
+  - type: markdown
+    attributes:
+      value: |
+        Make sure you provide plenty of [links]() to external documentation and inline code examples like so:
+
+        ```js
+        function myAwesomeNextAuthFeature() {
+          return 💚
+        }
+        ```
+
+        Take time thinking about what you want to say and help us understand your proposal making sure that this description contains:
+
+        - **purpose of the feature**
+        - **potential problems**
+        - **potential alternatives**
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: How to reproduce ☕️ 
+      description: If you have a CodeSandbox playground or some code snippets to help us visualize your idea better, please provide it here.
+    validations:
+      required: true
+  - type: markdown
+    attributes:
+      value: |
+        You can use one of the templates set up on **CodeSandbox** to better illustrate your idea:
+
+        - [`next-auth-example`](https://codesandbox.io/s/next-auth-example-1kktb)
+        - [`next-auth-typescript-example`](https://codesandbox.io/s/next-auth-typescript-example-se32w)        
+
+  - type: dropdown
+    id: pr
+    attributes:
+      label: Contributing 🙌🏽
+      multiple: false
+      options:
+        - "Yes, I am willing to help implement this feature in a PR"
+        - "No, I am afraid I cannot help regarding this"
+    validations:
+      required: true
+  - type: markdown
+    attributes: 
+      value: |
+        It takes a lot of work 🏋🏻‍♀️ maintaining a library like `next-auth`; any contribution is more than welcome 💚
+  
--- a/.github/ISSUE_TEMPLATE/question.md
+++ b/.github/ISSUE_TEMPLATE/question.md
@@ -1,32 +0,0 @@
---
-name: Question
-about: Ask a question about NextAuth.js or for help using it
-labels: question
-assignees: ""
---
-
-## Question 💬
-
-Please provide an in-depth description of the question you have.
-
-Make sure you [link]() to external documentation if necessary and provide inline code examples like so:
-
-```js
-function myAwesomeNextAuthFeature() {
-  return 💚
-}
-```
-
-**NOTE:** Questions will be converted to Discussions. You can find them [here](https://github.com/nextauthjs/next-auth/discussions)!
-
-## How to reproduce ☕️
-
-We encourage you to use the template set-up on **CodeSandbox** as a playground to represent your question or doubt:
-
- [`next-auth-example`](https://codesandbox.io/s/next-auth-example-1kktb)
-
-## Contributing 🙌🏽
-
-It takes a lot of work 🏋🏻‍♀️ maintaining a library like `next-auth`; any contribution is more than welcome 💚
-
-In case you're willing to help answer this question, please let us know here, and we'll reach you 😊 . Otherwise, you can have a look at the issues labelled with [`"good first issue"`](https://github.com/nextauthjs/next-auth/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) and pick any of them.
--- a/.github/ISSUE_TEMPLATE/question.yaml
+++ b/.github/ISSUE_TEMPLATE/question.yaml
@@ -0,0 +1,62 @@
+name: Question
+description: Ask a question about NextAuth.js or for help using it
+labels: question
+
+# note: markdown sections will NOT appear as part of the issue as per documentation, rather they provide context to the user
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema#markdown
+
+body:
+
+  - type: markdown
+    attributes:
+      value: |
+        We are glad that you have a question about this library. Please provide the following information:
+
+  - type: textarea
+    id: question
+    attributes:
+      label: Question 💬
+      description: Please provide an in-depth description of the question you have.
+    validations:
+      required: true
+  - type: markdown
+    attributes:
+      value: |   
+        Make sure you [link]() to external documentation if necessary and provide inline code examples like so:
+
+        ```js
+        function myAwesomeNextAuthFeature() {
+          return 💚
+        }
+        ```
+
+        **NOTE:** Questions will be converted to Discussions. You can find them [here](https://github.com/nextauthjs/next-auth/discussions)!    
+
+  - type: textarea
+    id: reproduction
+    attributes: 
+      label: How to reproduce ☕️ 
+      description: Please provide a link to a minimal reproduction or code snippets that represents your question
+    validations:
+      required: true 
+  - type: markdown
+    attributes:
+      value: |
+        We encourage you to use the template set-up on **CodeSandbox** as a playground to represent your question or doubt:
+        - [`next-auth-example`](https://codesandbox.io/s/next-auth-example-1kktb)
+  
+  - type: dropdown
+    id: pr
+    attributes:
+      label: Contributing 🙌🏽
+      multiple: false
+      options:
+        - "Yes, I am willing to help answer this question in a PR"
+        - "No, I am afraid I cannot help regarding this"
+    validations:
+      required: true
+  - type: markdown
+    attributes: 
+      value: |
+        It takes a lot of work 🏋🏻‍♀️ maintaining a library like `next-auth`; any contribution is more than welcome 💚
+  
--- a/.github/ISSUE_TEMPLATE/typescript.md
+++ b/.github/ISSUE_TEMPLATE/typescript.md
@@ -1,36 +0,0 @@
---
-name: TypeScript
-about: Ask a question about NextAuth.js TypeScript integration
-labels:
-  - question
-  - TypeScript
-assignees:
-  - lluia
-  - balazsorban44
---
-
-## Question 💬
-
-Please provide an in-depth description of the question you have when using NextAuth.js on a Typescript project or when consuming the built-in types for `next-auth`.
-
-Make sure you [link]() to external documentation if necessary and provide inline code examples like so:
-
-```js
-function myAwesomeNextAuthFeature() {
-  return 💚
-}
-```
-
-**NOTE:** Questions will be converted to Discussions. You can find them [here](https://github.com/nextauthjs/next-auth/discussions)!
-
-## How to reproduce ☕️
-
-We encourage you to use the template set-up on **CodeSandbox** as a playground to represent your question or doubt:
-
- [`next-auth-typescript-example`](https://codesandbox.io/s/next-auth-typescript-example-se32w)
-
-## Contributing 🙌🏽
-
-It takes a lot of work 🏋🏻‍♀️ maintaining a library like `next-auth`; any contribution is more than welcome 💚
-
-In case you're willing to help answer this TypeScript question, please let us know here, and we'll reach you 😊 . Otherwise, you can have a look at the issues labelled with [`"good first issue"`](https://github.com/nextauthjs/next-auth/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) and pick any of them.
--- a/.github/ISSUE_TEMPLATE/typescript.yaml
+++ b/.github/ISSUE_TEMPLATE/typescript.yaml
@@ -0,0 +1,58 @@
+name: TypeScript
+description: Ask a question about NextAuth.js TypeScript integration
+labels: [question, TypeScript]
+assignees: [lluia, balazsorban44]
+
+# note: markdown sections will NOT appear as part of the issue as per documentation, rather they provide context to the user
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema#markdown
+
+body:
+  - type: textarea
+    id: question
+    attributes:
+      label: Question 💬
+      description: Please provide an in-depth description of the question you have when using NextAuth.js on a Typescript project or when consuming the built-in types for `next-auth`.
+    validations:
+      required: true
+  - type: markdown
+    attributes:
+      value: |
+        Make sure you [link]() to external documentation if necessary and provide inline code examples like so:
+
+        ```js
+        function myAwesomeNextAuthFeature() {
+          return 💚
+        }
+        ```
+
+        **NOTE:** Questions will be converted to Discussions. You can find them [here](https://github.com/nextauthjs/next-auth/discussions)!    
+
+  - type: textarea
+    id: codesandbox
+    attributes: 
+      label: How to reproduce ☕️ 
+      description: Please provide a link to a minimal reproduction or code snippets that represents your question
+    validations:
+      required: true 
+  - type: markdown
+    attributes:
+      value: |
+        We encourage you to use the template set-up on **CodeSandbox** as a playground to represent your question or doubt:
+        - [`next-auth-typescript-example`](https://codesandbox.io/s/next-auth-typescript-example-se32w)
+  
+
+  - type: dropdown
+    id: pr
+    attributes:
+      label: Contributing 🙌🏽
+      multiple: false
+      options:
+        - "Yes, I am willing to help answer this question in a PR"
+        - "No, I am afraid I cannot help regarding this"
+    validations:
+      required: true
+  - type: markdown
+    attributes: 
+      value: |
+        It takes a lot of work 🏋🏻‍♀️ maintaining a library like `next-auth`; any contribution is more than welcome 💚
+  
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-name: Release Flow
+name: Release

 on:
  push:
@@ -11,37 +11,66 @@ on:

 jobs:
  test:
-    name: Tests
+    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Init
        uses: actions/checkout@v2
      - name: Setup Node
        uses: actions/setup-node@v1
+        with:
+          node-version: 16
      - name: Dependencies
        uses: bahmutov/npm-install@v1
+      - name: Build
+        run: npm run build
      - name: Run tests
-        run: npm test -- --coverage --verbose
+        run: npm test -- --coverage --verbose && npm run test:types
      - name: Coverage
        uses: codecov/codecov-action@v1
        with:
          directory: ./coverage
          fail_ci_if_error: false
-      - name: Build
-        run: npm run build
-  release:
-    name: Release
-    needs: test
+  release-branch:
+    name: Publish branch
    runs-on: ubuntu-latest
+    needs: test
+    if: ${{ github.event_name == 'push' }}
+    environment: Production
    steps:
      - name: Init
        uses: actions/checkout@v2
      - name: Setup Node
        uses: actions/setup-node@v1
+        with:
+          node-version: 16
      - name: Dependencies
        uses: bahmutov/npm-install@v1
-      - name: Release
+      - name: Publish to npm and GitHub
        run: npx semantic-release@17
        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-          NPM_TOKEN: ${{secrets.NPM_TOKEN}}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  release-pr:
+    name: Publish PR
+    runs-on: ubuntu-latest
+    needs: test
+    if: ${{ github.event_name == 'pull_request' }}
+    environment: Preview
+    steps:
+      - name: Init
+        uses: actions/checkout@v2
+      - name: Setup Node
+        uses: actions/setup-node@v1
+        with:
+          node-version: 16
+      - name: Dependencies
+        uses: bahmutov/npm-install@v1
+      - name: Publish to npm
+        run: |
+          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> .npmrc
+          npm run version:pr
+          npm publish --access public --tag experimental
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          PR_NUMBER: ${{ github.event.number }}
--- a/.gitignore
+++ b/.gitignore
@@ -61,4 +61,9 @@ app/yarn.lock
 /prisma/migrations

 # Tests
-/coverage
+/coverage
+
+# v4
+packages
+apps
+docs/providers.json
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -14,22 +14,22 @@ appearance, race, religion, or sexual identity and orientation.
 Examples of behavior that contributes to creating a positive environment
 include:

-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members

 Examples of unacceptable behavior by participants include:

-* The use of sexualized language or imagery and unwelcome sexual attention or
-advances
-* Trolling, insulting/derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or electronic
-address, without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-professional setting
+- The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting

 ## Our Responsibilities

@@ -55,11 +55,11 @@ further defined and clarified by project maintainers.
 ## Enforcement

 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting me@iaincollins.com. All complaints will be reviewed and
-investigated and will result in a response that is deemed necessary and
-appropriate to the circumstances. The project team is obligated to maintain
-confidentiality with regard to the reporter of an incident. Further details of
-specific enforcement policies may be posted separately.
+reported by contacting me@iaincollins.com or info@balazsorban.com and yo@ndo.dev.
+All complaints will be reviewed and investigated and will result in a response
+that is deemed necessary and appropriate to the circumstances. The project team
+is obligated to maintain confidentiality with regard to the reporter of an
+incident. Further details of specific enforcement policies may be posted separately.

 Project maintainers who do not follow or enforce the Code of Conduct in good
 faith may face temporary or permanent repercussions as determined by other
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -11,43 +11,49 @@ Please raise any significant new functionality or breaking change an issue for d
 ## For contributors

 Anyone can be a contributor. Either you found a typo, or you have an awesome feature request you could implement, we encourage you to create a Pull Request.
+
 ### Pull Requests

-* The latest changes are always in `main`, so please make your Pull Request against that branch.
-* Pull Requests should be raised for any change
-* Pull Requests need approval of a [core contributor](https://next-auth.js.org/contributors#core-team) before merging
-* We use ESLint/Prettier for linting/formatting, so please run `npm run lint:fix` before committing to make resolving conflicts easier (VSCode users, check out [this ESLint extension](https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint) and [this Prettier extension](https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode) to fix lint and formatting issues in development)
-* We encourage you to test your changes, and if you have the opportunity, please make those tests part of the Pull Request
-* If you add new functionality, please provide the corresponding documentation as well and make it part of the Pull Request
+- The latest changes are always in `main`, so please make your Pull Request against that branch.
+- Pull Requests should be raised for any change
+- Pull Requests need approval of a [core contributor](https://next-auth.js.org/contributors#core-team) before merging
+- We use ESLint/Prettier for linting/formatting, so please run `npm run lint:fix` before committing to make resolving conflicts easier (VSCode users, check out [this ESLint extension](https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint) and [this Prettier extension](https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode) to fix lint and formatting issues in development)
+- We encourage you to test your changes, and if you have the opportunity, please make those tests part of the Pull Request
+- If you add new functionality, please provide the corresponding documentation as well and make it part of the Pull Request

 ### Setting up local environment

-A quick guide on how to setup *next-auth* locally to work on it and test out any changes:
+A quick guide on how to setup _next-auth_ locally to work on it and test out any changes:
+
+The dev application requires you to use `npm@7`.

 1. Clone the repo:
+
 ```sh
 git clone git@github.com:nextauthjs/next-auth.git
 cd next-auth
 ```

-2. Install packages:
+2. Install packages, set up the dev application:
+
 ```sh
-npm i && npm run dev:setup
+npm run dev:setup
 ```

 3. Populate `.env.local`:
-   
-    Copy `app/.env.local.example` to `app/.env.local`, and add your env variables for each provider you want to test.
+
+   Copy `app/.env.local.example` to `app/.env.local`, and add your env variables for each provider you want to test.

 > NOTE: You can add any environment variables to .env.local that you would like to use in your dev app.
 > You can find the next-auth config under`app/pages/api/auth/[...nextauth].js`.

 1. Start the dev application/server:
+
 ```sh
 npm run dev
 ```

-Your dev application will be available on ```http://localhost:3000```
+Your dev application will be available on `http://localhost:3000`

 That's it! 🎉

@@ -64,6 +70,7 @@ When running `npm run dev`, you start a Next.js dev server on `http://localhost:
 #### Providers

 If you think your custom provider might be useful to others, we encourage you to open a PR and add it to the built-in list so others can discover it much more easily! You only need to add two changes:
+
 1. Add your config: [`src/providers/{provider}.js`](https://github.com/nextauthjs/next-auth/tree/main/src/providers) (Make sure you use a named default export, like `export default function YourProvider`!)
 2. Add provider documentation: [`www/docs/providers/{provider}.md`](https://github.com/nextauthjs/next-auth/tree/main/www/docs/providers)

@@ -73,40 +80,27 @@ You can look at the existing built-in providers for inspiration.

 #### Databases

-Included is a Docker Compose file that starts up MySQL, PostgreSQL, and MongoDB databases on localhost.
-
-It will use port `3306`, `5432`, and `27017` on localhost respectively; please make sure those ports are not used by other services on localhost.
-
-You can start them with `npm run db:start` and stop them with `npm run db:stop`.
-
-You will need Docker and Docker Compose installed to be able to start / stop the databases.
-
-When stopping the databases, it will reset their contents.
-
+If you would like to contribute to an existing database adapter or help create a new one, head over to the [nextauthjs/adapters](https://www.github.com/nextauthjs/adapters) repository and follow the instructions provided there.
 #### Testing

 Tests can be run with `npm run test`.

 Automated tests are currently crude and limited in functionality, but improvements are in development.
-
-Currently, to run tests you need to first have started local test databases (e.g. using `npm run db:start`).
-
-The databases can take a few seconds to start up, so you might need to give it a minute before running the tests.
-
 ## For maintainers

 We use [semantic-release](https://github.com/semantic-release/semantic-release) together with [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0) to automate releases. This makes the maintenance process easier and less error-prone to human error. Please study the "Conventional Commits" site to understand how to write a good commit message.

 When accepting Pull Requests, make sure the following:

-* Use "Squash and merge"
-* Make sure you merge contributor PRs into `main`
-* Rewrite the commit message to conform to the `Conventional Commits` style. Check the "Recommended Scopes" section for further advice.
-* Optionally link issues the PR will resolve (You can add "close" in front of the issue numbers to close the issues automatically, when the PR is merged. `semantic-release` will also comment back to connected issues and PRs, notifying the users that a feature is added/bug fixed, etc.)
+- Use "Squash and merge"
+- Make sure you merge contributor PRs into `main`
+- Rewrite the commit message to conform to the `Conventional Commits` style. Check the "Recommended Scopes" section for further advice.
+- Optionally link issues the PR will resolve (You can add "close" in front of the issue numbers to close the issues automatically, when the PR is merged. `semantic-release` will also comment back to connected issues and PRs, notifying the users that a feature is added/bug fixed, etc.)

 ### Recommended Scopes

 A typical conventional commit looks like this:
+
 ```
 type(scope): title

@@ -121,9 +115,8 @@ Some recommended scopes are:
 - **adapter** - Adapter related changes. (eg.: "feat(adapter): add X provider", "docs(provider): fix typo in X documentation"
 - **db** - Database related changes. (eg.: "feat(db): add X database", "docs(db): fix typo in X documentation"
 - **deps** - Adding/removing/updating a dependency (eg.: "chore(deps): add X")
-  
-> NOTE: If you are not sure which scope to use, you can simply ignore it. (eg.: "feat: add something"). Adding the correct type already helps a lot when analyzing the commit messages.

+> NOTE: If you are not sure which scope to use, you can simply ignore it. (eg.: "feat: add something"). Adding the correct type already helps a lot when analyzing the commit messages.

 ### Skipping a release

--- a/README.md
+++ b/README.md
@@ -38,7 +38,7 @@ It is designed from the ground up to support Next.js and Serverless.
 npm install --save next-auth
 ```

-The easiest way to continue getting started, is to follow the [getting started](https://next-auth.js.org/getting-started/example) section in our docs. 
+The easiest way to continue getting started, is to follow the [getting started](https://next-auth.js.org/getting-started/example) section in our docs.

 We also have a section of [tutorials](https://next-auth.js.org/tutorials) for those looking for more specific examples.

@@ -48,36 +48,36 @@ See [next-auth.js.org](https://next-auth.js.org) for more information and docume

 ### Flexible and easy to use

-* Designed to work with any OAuth service, it supports OAuth 1.0, 1.0A and 2.0
-* Built-in support for [many popular sign-in services](https://next-auth.js.org/configuration/providers)
-* Supports email / passwordless authentication
-* Supports stateless authentication with any backend (Active Directory, LDAP, etc)
-* Supports both JSON Web Tokens and database sessions
-* Designed for Serverless but runs anywhere (AWS Lambda, Docker, Heroku, etc…)
+- Designed to work with any OAuth service, it supports OAuth 1.0, 1.0A and 2.0
+- Built-in support for [many popular sign-in services](https://next-auth.js.org/configuration/providers)
+- Supports email / passwordless authentication
+- Supports stateless authentication with any backend (Active Directory, LDAP, etc)
+- Supports both JSON Web Tokens and database sessions
+- Designed for Serverless but runs anywhere (AWS Lambda, Docker, Heroku, etc…)

 ### Own your own data

 NextAuth.js can be used with or without a database.

-* An open source solution that allows you to keep control of your data
-* Supports Bring Your Own Database (BYOD) and can be used with any database
-* Built-in support for [MySQL, MariaDB, Postgres, Microsoft SQL Server, MongoDB and SQLite](https://next-auth.js.org/configuration/databases)
-* Works great with databases from popular hosting providers
-* Can also be used *without a database* (e.g. OAuth + JWT)
+- An open source solution that allows you to keep control of your data
+- Supports Bring Your Own Database (BYOD) and can be used with any database
+- Built-in support for [MySQL, MariaDB, Postgres, Microsoft SQL Server, MongoDB and SQLite](https://next-auth.js.org/configuration/databases)
+- Works great with databases from popular hosting providers
+- Can also be used _without a database_ (e.g. OAuth + JWT)

 ### Secure by default

-* Promotes the use of passwordless sign in mechanisms
-* Designed to be secure by default and encourage best practice for safeguarding user data
-* Uses Cross Site Request Forgery Tokens on POST routes (sign in, sign out)
-* Default cookie policy aims for the most restrictive policy appropriate for each cookie
-* When JSON Web Tokens are enabled, they are signed by default (JWS) with HS512
-* Use JWT encryption (JWE) by setting the option `encryption: true` (defaults to A256GCM)
-* Auto-generates symmetric signing and encryption keys for developer convenience
-* Features tab/window syncing and keepalive messages to support short lived sessions
-* Attempts to implement the latest guidance published by [Open Web Application Security Project](https://owasp.org/)
+- Promotes the use of passwordless sign in mechanisms
+- Designed to be secure by default and encourage best practice for safeguarding user data
+- Uses Cross Site Request Forgery Tokens on POST routes (sign in, sign out)
+- Default cookie policy aims for the most restrictive policy appropriate for each cookie
+- When JSON Web Tokens are enabled, they are signed by default (JWS) with HS512
+- Use JWT encryption (JWE) by setting the option `encryption: true` (defaults to A256GCM)
+- Auto-generates symmetric signing and encryption keys for developer convenience
+- Features tab/window syncing and keepalive messages to support short lived sessions
+- Attempts to implement the latest guidance published by [Open Web Application Security Project](https://owasp.org/)

-Advanced options allow you to define your own routines to handle controlling what accounts are allowed to sign in, for encoding and decoding JSON Web Tokens and to set custom cookie security policies and session properties, so you can control who is able to sign in and how often sessions have to be re-validated. 
+Advanced options allow you to define your own routines to handle controlling what accounts are allowed to sign in, for encoding and decoding JSON Web Tokens and to set custom cookie security policies and session properties, so you can control who is able to sign in and how often sessions have to be re-validated.

 ### TypeScript

@@ -90,50 +90,52 @@ The package at `@types/next-auth` is now deprecated.
 ### Add API Route

 ```javascript
-import NextAuth from 'next-auth'
-import Providers from 'next-auth/providers'
+import NextAuth from "next-auth"
+import Providers from "next-auth/providers"

 export default NextAuth({
  providers: [
    // OAuth authentication providers
    Providers.Apple({
      clientId: process.env.APPLE_ID,
-      clientSecret: process.env.APPLE_SECRET
+      clientSecret: process.env.APPLE_SECRET,
    }),
    Providers.Google({
      clientId: process.env.GOOGLE_ID,
-      clientSecret: process.env.GOOGLE_SECRET
+      clientSecret: process.env.GOOGLE_SECRET,
    }),
    // Sign in with passwordless email link
    Providers.Email({
      server: process.env.MAIL_SERVER,
-      from: '<no-reply@example.com>'
+      from: "<no-reply@example.com>",
    }),
  ],
  // SQL or MongoDB database (or leave empty)
-  database: process.env.DATABASE_URL
+  database: process.env.DATABASE_URL,
 })
 ```

 ### Add React Component

 ```javascript
-import {
-  useSession, signIn, signOut
-} from 'next-auth/client'
+import { useSession, signIn, signOut } from "next-auth/client"

 export default function Component() {
-  const [ session, loading ] = useSession()
-  if(session) {
-    return <>
-      Signed in as {session.user.email} <br/>
-      <button onClick={() => signOut()}>Sign out</button>
-    </>
+  const [session, loading] = useSession()
+  if (session) {
+    return (
+      <>
+        Signed in as {session.user.email} <br />
+        <button onClick={() => signOut()}>Sign out</button>
+      </>
+    )
  }
-  return <>
-    Not signed in <br/>
-    <button onClick={() => signIn()}>Sign in</button>
-  </>
+  return (
+    <>
+      Not signed in <br />
+      <button onClick={() => signIn()}>Sign in</button>
+    </>
+  )
 }
 ```

@@ -145,14 +147,44 @@ export default function Component() {
  <img width="500px" src="https://contrib.rocks/image?repo=nextauthjs/next-auth" />
 </a>
 <div>
-<a href="https://vercel.com?utm_source=nextauthjs&utm_campaign=oss">
-<img width="170px" src="https://raw.githubusercontent.com/nextauthjs/next-auth/canary/www/static/img/powered-by-vercel.svg" alt="Powered By Vercel" />
-</a>
-</div>
-<div>
-<p align="left">Thanks to Vercel sponsoring this project by allowing it to be deployed for free for the entire NextAuth.js Team</p>
+<a href="https://vercel.com?utm_source=nextauthjs&utm_campaign=oss"></a>
 </div>

+### Support
+
+We're happy to announce we've recently created an [OpenCollective](https://opencollective.org/nextauth) for individuals and companies looking to contribute financially to the project!
+
+<!--sponsors start-->
+<table>
+  <tbody>
+    <tr>
+      <td align="center" valign="top">
+        <a href="https://vercel.com" target="_blank">
+          <img width="128px" src="https://avatars.githubusercontent.com/u/14985020?v=4" alt="Vercel Logo" />
+        </a><br />
+        <div>Vercel</div><br />
+        <sub>🥉 Bronze Financial Sponsor <br /> ☁️ Infrastructure Support</sub>
+      </td>
+      <td align="center" valign="top">
+        <a href="https://prisma.io" target="_blank">
+          <img width="128px" src="https://avatars.githubusercontent.com/u/17219288?v=4" alt="Prisma Logo" />
+        </a><br />
+        <div>Prisma</div><br />
+        <sub>🥉 Bronze Financial Sponsor</sub>
+      </td>
+      <td align="center" valign="top">
+        <a href="https://checklyhq.com" target="_blank">
+          <img width="128px" src="https://avatars.githubusercontent.com/u/25982255?v=4" alt="Checkly Logo" />
+        </a><br />
+        <div>Checkly</div><br />
+        <sub>☁️ Infrastructure Support</sub>
+      </td>
+    </tr><tr></tr>
+  </tbody>
+</table>
+<br />
+<!--sponsors end-->
+
 ## Contributing

 We're open to all community contributions! If you'd like to contribute in any way, please first read our [Contributing Guide](https://github.com/nextauthjs/next-auth/blob/canary/CONTRIBUTING.md).
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -14,11 +14,11 @@ We request that you contact us directly to report serious issues that might impa

 If you contact us regarding a serious issue:

-* We will endeavor to get back to you within 72 hours.
-* We will aim to publish a fix within 30 days.
-* We will disclose the issue (and credit you, with your consent) once a fix to resolve the issue has been released.
-* If 90 days has elapsed and we still don't have a fix, we will disclose the issue publicly.
+- We will endeavor to get back to you within 72 hours.
+- We will aim to publish a fix within 30 days.
+- We will disclose the issue (and credit you, with your consent) once a fix to resolve the issue has been released.
+- If 90 days has elapsed and we still don't have a fix, we will disclose the issue publicly.

-Currently, the best way to report an issue is by emailing me@iaincollins.com
+Currently, the best way to report an issue is by contacting us via email at me@iaincollins.com or info@balazsorban.com and yo@ndo.dev.

 For less serious issues (e.g. RFC compliance for unsupported flows or potential issues that may cause a problem future or default behaviour / options) it is appropriate to submit these these publically as bug reports or feature requests or to raise a question to open a discussion around them.
--- a/app/.env.local.example
+++ b/app/.env.local.example
@@ -23,8 +23,6 @@ TWITTER_SECRET=
 EMAIL_SERVER=smtps://user@gmail.com:password@smtp.gmail.com:465
 EMAIL_FROM=user@gmail.com

-# You can use any of these as the "DATABASE_URL" for
-# databases started with Docker using `npm run db:start`.
 # Note: If using with Prisma adapter, you need to use a `.env`
 # file rather than a `.env.local` file to configure env vars.
 # Postgres: DATABASE_URL=postgres://nextauth:password@127.0.0.1:5432/nextauth?synchronize=true
--- a/app/components/footer.js
+++ b/app/components/footer.js
@@ -1,17 +1,29 @@
-import Link from 'next/link'
-import styles from './footer.module.css'
-import { version } from 'package.json'
+import Link from "next/link"
+import styles from "./footer.module.css"
+import packageJSON from "package.json"

-export default function Footer () {
+export default function Footer() {
  return (
    <footer className={styles.footer}>
      <hr />
      <ul className={styles.navItems}>
-        <li className={styles.navItem}><a href='https://next-auth.js.org'>Documentation</a></li>
-        <li className={styles.navItem}><a href='https://www.npmjs.com/package/next-auth'>NPM</a></li>
-        <li className={styles.navItem}><a href='https://github.com/nextauthjs/next-auth-example'>GitHub</a></li>
-        <li className={styles.navItem}><Link href='/policy'><a>Policy</a></Link></li>
-        <li className={styles.navItem}><em>{version}</em></li>
+        <li className={styles.navItem}>
+          <a href="https://next-auth.js.org">Documentation</a>
+        </li>
+        <li className={styles.navItem}>
+          <a href="https://www.npmjs.com/package/next-auth">NPM</a>
+        </li>
+        <li className={styles.navItem}>
+          <a href="https://github.com/nextauthjs/next-auth-example">GitHub</a>
+        </li>
+        <li className={styles.navItem}>
+          <Link href="/policy">
+            <a>Policy</a>
+          </Link>
+        </li>
+        <li className={styles.navItem}>
+          <em>{packageJSON.version}</em>
+        </li>
      </ul>
    </footer>
  )
--- a/app/package.json
+++ b/app/package.json
@@ -14,7 +14,7 @@
  },
  "license": "ISC",
  "dependencies": {
-    "next": "^10.1.3",
+    "next": "^11.0.1",
    "react": "^17.0.2",
    "react-dom": "^17.0.2"
  },
--- a/config/version-pr.js
+++ b/config/version-pr.js
@@ -0,0 +1,17 @@
+const fs = require("fs-extra")
+const path = require("path")
+
+try {
+  const packageJSONPath = path.join(process.cwd(), "package.json")
+  const packageJSON = JSON.parse(fs.readFileSync(packageJSONPath, "utf8"))
+
+  const sha8 = process.env.GITHUB_SHA.substr(0, 8)
+  const prNumber = process.env.PR_NUMBER
+
+  packageJSON.version = `0.0.0-pr.${prNumber}.${sha8}`
+
+  fs.writeFileSync(packageJSONPath, JSON.stringify(packageJSON))
+} catch (error) {
+  console.error("Could not set PR version", error)
+  process.exit(1)
+}
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "next-auth",
-  "version": "0.0.0-semantically-released",
+  "version": "3.29.9",
  "description": "Authentication for Next.js",
  "homepage": "https://next-auth.js.org",
  "repository": "https://github.com/nextauthjs/next-auth.git",
@@ -32,7 +32,7 @@
    "build": "npm run build:js && npm run build:css",
    "build:js": "node ./config/build.js && babel --config-file ./config/babel.config.js src --out-dir dist",
    "build:css": "postcss --config config/postcss.config.js src/**/*.css --base src --dir dist && node config/wrap-css.js",
-    "dev:setup": "npm run build:css && cd app && npm i",
+    "dev:setup": "npm i && npm run build:css && cd app && npm i",
    "dev": "cd app && npm run dev",
    "watch": "npm run watch:js | npm run watch:css",
    "watch:js": "babel --config-file ./config/babel.config.js --watch src --out-dir dist",
@@ -42,7 +42,8 @@
    "test:types": "dtslint types --onlyTestTsNext",
    "prepublishOnly": "npm run build",
    "lint": "eslint .",
-    "lint:fix": "eslint . --fix"
+    "lint:fix": "eslint . --fix",
+    "version:pr": "node ./config/version-pr"
  },
  "files": [
    "dist",
@@ -63,8 +64,8 @@
  "license": "ISC",
  "dependencies": {
    "@babel/runtime": "^7.14.0",
-    "@next-auth/prisma-legacy-adapter": "0.0.1-canary.127",
-    "@next-auth/typeorm-legacy-adapter": "0.0.2-canary.129",
+    "@next-auth/prisma-legacy-adapter": "0.1.2",
+    "@next-auth/typeorm-legacy-adapter": "0.1.4",
    "futoin-hkdf": "^1.3.2",
    "jose": "^1.27.2",
    "jsonwebtoken": "^8.5.1",
@@ -93,13 +94,10 @@
    "@babel/plugin-transform-runtime": "^7.13.15",
    "@babel/preset-env": "^7.9.6",
    "@babel/preset-react": "^7.13.13",
-    "@semantic-release/commit-analyzer": "^8.0.1",
-    "@semantic-release/github": "^7.2.0",
-    "@semantic-release/npm": "7.0.8",
-    "@semantic-release/release-notes-generator": "^9.0.1",
    "@testing-library/jest-dom": "^5.12.0",
    "@testing-library/react": "^11.2.6",
    "@testing-library/user-event": "^13.1.9",
+    "@types/nodemailer": "^6.4.2",
    "@types/react": "^17.0.0",
    "@typescript-eslint/eslint-plugin": "^4.22.0",
    "@typescript-eslint/parser": "^4.22.0",
@@ -121,13 +119,13 @@
    "husky": "^6.0.0",
    "jest": "^26.6.3",
    "msw": "^0.28.2",
-    "next": "^10.0.5",
+    "next": "^11.0.1",
    "postcss-cli": "^7.1.1",
    "postcss-nested": "^4.2.1",
    "prettier": "^2.2.1",
    "pretty-quick": "^3.1.0",
-    "react": "^17.0.1",
-    "react-dom": "^17.0.1",
+    "react": "^17.0.2",
+    "react-dom": "^17.0.2",
    "typescript": "^4.1.3",
    "whatwg-fetch": "^3.6.2"
  },
--- a/src/providers/email.js
+++ b/src/providers/email.js
@@ -43,7 +43,7 @@ const sendVerificationRequest = ({
      },
      (error) => {
        if (error) {
-          logger.error("SEND_VERIFICATION_EMAIL_ERROR", email, error)
+          logger.error("SEND_VERIFICATION_EMAIL_ERROR", error)
          return reject(new Error("SEND_VERIFICATION_EMAIL_ERROR", error))
        }
        return resolve()
@@ -53,12 +53,11 @@ const sendVerificationRequest = ({
 }

 // Email HTML body
-const html = ({ url, site, email }) => {
-  // Insert invisible space into domains and email address to prevent both the
-  // email address and the domain from being turned into a hyperlink by email
+const html = ({ url, site }) => {
+  // Insert invisible space into domains to prevent the
+  // the domain from being turned into a hyperlink by email
  // clients like Outlook and Apple mail, as this is confusing because it seems
-  // like they are supposed to click on their email address to sign in.
-  const escapedEmail = `${email.replace(/\./g, "&#8203;.")}`
+  // like they are supposed to click it to sign in.
  const escapedSite = `${site.replace(/\./g, "&#8203;.")}`

  // Some simple styling options
@@ -73,17 +72,12 @@ const html = ({ url, site, email }) => {
 <body style="background: ${backgroundColor};">
  <table width="100%" border="0" cellspacing="0" cellpadding="0">
    <tr>
-      <td align="center" style="padding: 10px 0px 20px 0px; font-size: 22px; font-family: Helvetica, Arial, sans-serif; color: ${textColor};">
-        <strong>${escapedSite}</strong>
+      <td align="center" style="padding: 10px 0px; font-size: 22px; font-family: Helvetica, Arial, sans-serif; color: ${textColor};">
+        Sign in to <strong>${escapedSite}</strong>
      </td>
    </tr>
  </table>
  <table width="100%" border="0" cellspacing="20" cellpadding="0" style="background: ${mainBackgroundColor}; max-width: 600px; margin: auto; border-radius: 10px;">
-    <tr>
-      <td align="center" style="padding: 10px 0px 0px 0px; font-size: 18px; font-family: Helvetica, Arial, sans-serif; color: ${textColor};">
-        Sign in as <strong>${escapedEmail}</strong>
-      </td>
-    </tr>
    <tr>
      <td align="center" style="padding: 20px 0;">
        <table border="0" cellspacing="0" cellpadding="0">
--- a/src/providers/freshbooks.js
+++ b/src/providers/freshbooks.js
@@ -0,0 +1,20 @@
+export default function Freshbooks(options) {
+  return {
+  id: 'freshbooks',
+  name: 'Freshbooks',
+  type: 'oauth',
+  version: '2.0',
+  params: { grant_type: 'authorization_code' },
+  accessTokenUrl: 'https://api.freshbooks.com/auth/oauth/token',
+  authorizationUrl: 'https://auth.freshbooks.com/service/auth/oauth/authorize?response_type=code',
+  profileUrl: 'https://api.freshbooks.com/auth/api/v1/users/me',
+  async profile(profile) {
+    return {
+      id: profile.response.id,
+      name: `${profile.response.first_name} ${profile.response.last_name}`,
+      email: profile.response.email,
+    };
+  },
+  ...options
+  };
+}
--- a/src/providers/naver.js
+++ b/src/providers/naver.js
@@ -0,0 +1,18 @@
+export default function Naver(options) {
+  return {
+    id: "naver",
+    name: "Naver",
+    type: "oauth",
+    version: "2.0",
+    params: { grant_type: "authorization_code" },
+    protection: ["state"],
+    accessTokenUrl: "https://nid.naver.com/oauth2.0/token",
+    authorizationUrl:
+      "https://nid.naver.com/oauth2.0/authorize?response_type=code",
+    profileUrl: "https://openapi.naver.com/v1/nid/me",
+    profile(profile) {
+      return profile.response
+    },
+    ...options,
+  }
+}
--- a/src/providers/onelogin.js
+++ b/src/providers/onelogin.js
@@ -0,0 +1,19 @@
+export default function OneLogin(options) {
+  return {
+    id: "onelogin",
+    name: "OneLogin",
+    type: "oauth",
+    version: "2.0",
+    scope: "openid profile name email",
+    params: { grant_type: "authorization_code" },
+    // These will be different depending on the Org.
+    accessTokenUrl: `https://${options.domain}/oidc/2/token`,
+    requestTokenUrl: `https://${options.domain}/oidc/2/auth`,
+    authorizationUrl: `https://${options.domain}/oidc/2/auth?response_type=code`,
+    profileUrl: `https://${options.domain}/oidc/2/me`,
+    profile(profile) {
+      return { ...profile, id: profile.sub }
+    },
+    ...options,
+  }
+}
--- a/src/providers/yandex.js
+++ b/src/providers/yandex.js
@@ -4,7 +4,7 @@ export default function Yandex(options) {
    name: "Yandex",
    type: "oauth",
    version: "2.0",
-    scope: "login:email login:info",
+    scope: "login:email login:info login:avatar",
    params: { grant_type: "authorization_code" },
    accessTokenUrl: "https://oauth.yandex.ru/token",
    requestTokenUrl: "https://oauth.yandex.ru/token",
@@ -15,7 +15,7 @@ export default function Yandex(options) {
        id: profile.id,
        name: profile.real_name,
        email: profile.default_email,
-        image: null,
+        image: profile.is_avatar_empty ? null : `https://avatars.yandex.net/get-yapic/${profile.default_avatar_id}/islands-200`,
      }
    },
    ...options,
--- a/src/server/index.js
+++ b/src/server/index.js
@@ -21,6 +21,16 @@ if (!process.env.NEXTAUTH_URL) {
  logger.warn("NEXTAUTH_URL", "NEXTAUTH_URL environment variable not set")
 }

+function isValidHttpUrl(url, baseUrl) {
+  try {
+    return /^https?:/.test(
+      new URL(url, url.startsWith("/") ? baseUrl : undefined).protocol
+    )
+  } catch {
+    return false
+  }
+}
+
 /**
 * @param {import("next").NextApiRequest} req
 * @param {import("next").NextApiResponse} res
@@ -71,6 +81,23 @@ async function NextAuthHandler(req, res, userOptions) {
      ...userOptions.cookies,
    }

+    const errorPage = userOptions.pages?.error ?? `${baseUrl}${basePath}/error`
+
+    const callbackUrlParam = req.query?.callbackUrl
+    if (callbackUrlParam && !isValidHttpUrl(callbackUrlParam, baseUrl)) {
+      return res.redirect(`${errorPage}?error=Configuration`)
+    }
+
+    const { callbackUrl: defaultCallbackUrl } = cookie.defaultCookies(
+      userOptions.useSecureCookies ?? baseUrl.startsWith("https://")
+    )
+    const callbackUrlCookie =
+      req.cookies?.[cookies?.callbackUrl?.name ?? defaultCallbackUrl.name]
+
+    if (callbackUrlCookie && !isValidHttpUrl(callbackUrlCookie, baseUrl)) {
+      return res.redirect(`${errorPage}?error=Configuration`)
+    }
+
    const secret = createSecret({ userOptions, basePath, baseUrl })

    const providers = parseProviders({
@@ -280,7 +307,9 @@ async function NextAuthHandler(req, res, userOptions) {
    }
    return res
      .status(400)
-      .end(`Error: HTTP ${req.method} is not supported for ${req.url}`)
+      .end(
+        `Error: This action with HTTP ${req.method} is not supported by NextAuth.js`
+      )
  })
 }

--- a/src/server/lib/cookie.js
+++ b/src/server/lib/cookie.js
@@ -8,115 +8,115 @@
 * As only partial functionlity is required, only the code we need has been incorporated here
 * (with fixes for specific issues) to keep dependancy size down.
 */
-export function set (res, name, value, options = {}) {
+export function set(res, name, value, options = {}) {
  const stringValue =
-    typeof value === 'object' ? 'j:' + JSON.stringify(value) : String(value)
+    typeof value === "object" ? "j:" + JSON.stringify(value) : String(value)

-  if ('maxAge' in options) {
+  if ("maxAge" in options) {
    options.expires = new Date(Date.now() + options.maxAge)
    options.maxAge /= 1000
  }

  // Preserve any existing cookies that have already been set in the same session
-  let setCookieHeader = res.getHeader('Set-Cookie') || []
+  let setCookieHeader = res.getHeader("Set-Cookie") || []
  // If not an array (i.e. a string with a single cookie) convert it into an array
  if (!Array.isArray(setCookieHeader)) {
    setCookieHeader = [setCookieHeader]
  }
  setCookieHeader.push(_serialize(name, String(stringValue), options))
-  res.setHeader('Set-Cookie', setCookieHeader)
+  res.setHeader("Set-Cookie", setCookieHeader)
 }

-function _serialize (name, val, options) {
+function _serialize(name, val, options) {
  const fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/ // eslint-disable-line no-control-regex

  const opt = options || {}
  const enc = opt.encode || encodeURIComponent

-  if (typeof enc !== 'function') {
-    throw new TypeError('option encode is invalid')
+  if (typeof enc !== "function") {
+    throw new TypeError("option encode is invalid")
  }

  if (!fieldContentRegExp.test(name)) {
-    throw new TypeError('argument name is invalid')
+    throw new TypeError("argument name is invalid")
  }

  const value = enc(val)

  if (value && !fieldContentRegExp.test(value)) {
-    throw new TypeError('argument val is invalid')
+    throw new TypeError("argument val is invalid")
  }

-  let str = name + '=' + value
+  let str = name + "=" + value

  if (opt.maxAge != null) {
    const maxAge = opt.maxAge - 0

    if (isNaN(maxAge) || !isFinite(maxAge)) {
-      throw new TypeError('option maxAge is invalid')
+      throw new TypeError("option maxAge is invalid")
    }

-    str += '; Max-Age=' + Math.floor(maxAge)
+    str += "; Max-Age=" + Math.floor(maxAge)
  }

  if (opt.domain) {
    if (!fieldContentRegExp.test(opt.domain)) {
-      throw new TypeError('option domain is invalid')
+      throw new TypeError("option domain is invalid")
    }

-    str += '; Domain=' + opt.domain
+    str += "; Domain=" + opt.domain
  }

  if (opt.path) {
    if (!fieldContentRegExp.test(opt.path)) {
-      throw new TypeError('option path is invalid')
+      throw new TypeError("option path is invalid")
    }

-    str += '; Path=' + opt.path
+    str += "; Path=" + opt.path
  } else {
-    str += '; Path=/'
+    str += "; Path=/"
  }

  if (opt.expires) {
    let expires = opt.expires
-    if (typeof opt.expires.toUTCString === 'function') {
+    if (typeof opt.expires.toUTCString === "function") {
      expires = opt.expires.toUTCString()
    } else {
      const dateExpires = new Date(opt.expires)
      expires = dateExpires.toUTCString()
    }
-    str += '; Expires=' + expires
+    str += "; Expires=" + expires
  }

  if (opt.httpOnly) {
-    str += '; HttpOnly'
+    str += "; HttpOnly"
  }

  if (opt.secure) {
-    str += '; Secure'
+    str += "; Secure"
  }

  if (opt.sameSite) {
    const sameSite =
-      typeof opt.sameSite === 'string'
+      typeof opt.sameSite === "string"
        ? opt.sameSite.toLowerCase()
        : opt.sameSite

    switch (sameSite) {
      case true:
-        str += '; SameSite=Strict'
+        str += "; SameSite=Strict"
        break
-      case 'lax':
-        str += '; SameSite=Lax'
+      case "lax":
+        str += "; SameSite=Lax"
        break
-      case 'strict':
-        str += '; SameSite=Strict'
+      case "strict":
+        str += "; SameSite=Strict"
        break
-      case 'none':
-        str += '; SameSite=None'
+      case "none":
+        str += "; SameSite=None"
        break
      default:
-        throw new TypeError('option sameSite is invalid')
+        throw new TypeError("option sameSite is invalid")
    }
  }

@@ -134,46 +134,47 @@ function _serialize (name, val, options) {
 * @TODO Review cookie settings (names, options)
 * @return {import("types").CookiesOptions}
 */
-export function defaultCookies (useSecureCookies) {
-  const cookiePrefix = useSecureCookies ? '__Secure-' : ''
+export function defaultCookies(useSecureCookies) {
+  const cookiePrefix = useSecureCookies ? "__Secure-" : ""
  return {
    // default cookie options
    sessionToken: {
      name: `${cookiePrefix}next-auth.session-token`,
      options: {
        httpOnly: true,
-        sameSite: 'lax',
-        path: '/',
-        secure: useSecureCookies
-      }
+        sameSite: "lax",
+        path: "/",
+        secure: useSecureCookies,
+      },
    },
    callbackUrl: {
      name: `${cookiePrefix}next-auth.callback-url`,
      options: {
-        sameSite: 'lax',
-        path: '/',
-        secure: useSecureCookies
-      }
+        httpOnly: true,
+        sameSite: "lax",
+        path: "/",
+        secure: useSecureCookies,
+      },
    },
    csrfToken: {
      // Default to __Host- for CSRF token for additional protection if using useSecureCookies
      // NB: The `__Host-` prefix is stricter than the `__Secure-` prefix.
-      name: `${useSecureCookies ? '__Host-' : ''}next-auth.csrf-token`,
+      name: `${useSecureCookies ? "__Host-" : ""}next-auth.csrf-token`,
      options: {
        httpOnly: true,
-        sameSite: 'lax',
-        path: '/',
-        secure: useSecureCookies
-      }
+        sameSite: "lax",
+        path: "/",
+        secure: useSecureCookies,
+      },
    },
    pkceCodeVerifier: {
      name: `${cookiePrefix}next-auth.pkce.code_verifier`,
      options: {
        httpOnly: true,
-        sameSite: 'lax',
-        path: '/',
-        secure: useSecureCookies
-      }
-    }
+        sameSite: "lax",
+        path: "/",
+        secure: useSecureCookies,
+      },
+    },
  }
 }
--- a/src/server/lib/csrf-token-handler.js
+++ b/src/server/lib/csrf-token-handler.js
@@ -3,7 +3,7 @@ import * as cookie from './cookie'

 /**
 * Ensure CSRF Token cookie is set for any subsequent requests.
- * Used as part of the strateigy for mitigation for CSRF tokens.
+ * Used as part of the strategy for mitigation for CSRF tokens.
 *
 * Creates a cookie like 'next-auth.csrf-token' with the value 'token|hash',
 * where 'token' is the CSRF token and 'hash' is a hash made of the token and
--- a/src/server/lib/default-callbacks.js
+++ b/src/server/lib/default-callbacks.js
@@ -15,7 +15,7 @@
 * @return {Promise<boolean|never>}  Return `true` (or a modified JWT) to allow sign in
 *                                   Return `false` to deny access
 */
-export async function signIn () {
+export async function signIn() {
  return true
 }

@@ -28,10 +28,9 @@ export async function signIn () {
 * @param  {string} baseUrl  Default base URL of site (can be used as fallback)
 * @return {Promise<string>} URL the client will be redirect to
 */
-export async function redirect (url, baseUrl) {
-  if (url.startsWith(baseUrl)) {
-    return url
-  }
+export async function redirect(url, baseUrl) {
+  if (url.startsWith("/")) return `${baseUrl}${url}`
+  else if (new URL(url).origin === baseUrl) return url
  return baseUrl
 }

@@ -43,7 +42,7 @@ export async function redirect (url, baseUrl) {
 * @param  {object} token    JSON Web Token (if enabled)
 * @return {Promise<object>} Session that will be returned to the client
 */
-export async function session (session) {
+export async function session(session) {
  return session
 }

@@ -59,6 +58,6 @@ export async function session (session) {
 * @param  {object} oAuthProfile  OAuth profile - only available on sign in
 * @return {Promise<object>}      JSON Web Token that will be saved
 */
-export async function jwt (token) {
+export async function jwt(token) {
  return token
 }
--- a/src/server/lib/oauth/callback.js
+++ b/src/server/lib/oauth/callback.js
@@ -30,6 +30,7 @@ export default async function oAuthCallback(req) {
          provider.id,
          code
        )
+        logger.debug("OAUTH_CALLBACK_HANDLER_ERROR", req.body)
        throw error
      }
    }
@@ -62,7 +63,7 @@ export default async function oAuthCallback(req) {

      return getProfile({ profileData, provider, tokens, user })
    } catch (error) {
-      logger.error("OAUTH_GET_ACCESS_TOKEN_ERROR", error, provider.id, code)
+      logger.error("OAUTH_GET_ACCESS_TOKEN_ERROR", error, provider.id)
      throw error
    }
  }
@@ -74,7 +75,11 @@ export default async function oAuthCallback(req) {

    // eslint-disable-next-line camelcase
    const { token_secret } = await client.getOAuthRequestToken(provider.params)
-    const tokens = await client.getOAuthAccessToken(oauth_token, token_secret, oauth_verifier)
+    const tokens = await client.getOAuthAccessToken(
+      oauth_token,
+      token_secret,
+      oauth_verifier
+    )
    const profileData = await client.get(
      provider.profileUrl,
      tokens.oauth_token,
@@ -143,11 +148,11 @@ async function getProfile({ profileData, tokens, provider, user }) {
    // If we didn't get a response either there was a problem with the provider
    // response *or* the user cancelled the action with the provider.
    //
-    // Unfortuately, we can't tell which - at least not in a way that works for
+    // Unfortunately, we can't tell which - at least not in a way that works for
    // all providers, so we return an empty object; the user should then be
    // redirected back to the sign up page. We log the error to help developers
    // who might be trying to debug this when configuring a new provider.
-    logger.error("OAUTH_PARSE_PROFILE_ERROR", exception, profileData)
+    logger.error("OAUTH_PARSE_PROFILE_ERROR", exception)
    return {
      profile: null,
      account: null,
--- a/src/server/lib/oauth/client.js
+++ b/src/server/lib/oauth/client.js
@@ -1,7 +1,7 @@
-import { OAuth, OAuth2 } from 'oauth'
-import querystring from 'querystring'
-import logger from '../../../lib/logger'
-import { sign as jwtSign } from 'jsonwebtoken'
+import { OAuth, OAuth2 } from "oauth"
+import querystring from "querystring"
+import logger from "../../../lib/logger"
+import { sign as jwtSign } from "jsonwebtoken"

 /**
 * @TODO Refactor to remove dependancy on 'oauth' package
@@ -9,8 +9,8 @@ import { sign as jwtSign } from 'jsonwebtoken'
 * would be easier to maintain if all the code was native to next-auth.
 * @param {import("types/providers").OAuthConfig} provider
 */
-export default function oAuthClient (provider) {
-  if (provider.version?.startsWith('2.')) {
+export default function oAuthClient(provider) {
+  if (provider.version?.startsWith("2.")) {
    // Handle OAuth v2.x
    const authorizationUrl = new URL(provider.authorizationUrl)
    const basePath = authorizationUrl.origin
@@ -34,9 +34,9 @@ export default function oAuthClient (provider) {
    provider.accessTokenUrl,
    provider.clientId,
    provider.clientSecret,
-    provider.version || '1.0',
+    provider.version || "1.0",
    provider.callbackUrl,
-    provider.encoding || 'HMAC-SHA1'
+    provider.encoding || "HMAC-SHA1"
  )

  // Promisify get() and getOAuth2AccessToken() for OAuth1
@@ -51,40 +51,48 @@ export default function oAuthClient (provider) {
      })
    })
  }
-  const originalGetOAuth1AccessToken = oauth1Client.getOAuthAccessToken.bind(oauth1Client)
+  const originalGetOAuth1AccessToken =
+    oauth1Client.getOAuthAccessToken.bind(oauth1Client)
  oauth1Client.getOAuthAccessToken = (...args) => {
    return new Promise((resolve, reject) => {
      // eslint-disable-next-line camelcase
-      originalGetOAuth1AccessToken(...args, (error, oauth_token, oauth_token_secret, params) => {
-        if (error) {
-          return reject(error)
+      originalGetOAuth1AccessToken(
+        ...args,
+        (error, oauth_token, oauth_token_secret, params) => {
+          if (error) {
+            return reject(error)
+          }
+
+          resolve({
+            // TODO: Remove, this is only kept for backward compativility
+            // These are not in the OAuth 1.x spec
+            accessToken: oauth_token,
+            refreshToken: oauth_token_secret,
+            results: params,
+
+            oauth_token,
+            oauth_token_secret,
+            params,
+          })
        }
-
-        resolve({
-          // TODO: Remove, this is only kept for backward compativility
-          // These are not in the OAuth 1.x spec
-          accessToken: oauth_token,
-          refreshToken: oauth_token_secret,
-          results: params,
-
-          oauth_token,
-          oauth_token_secret,
-          params
-        })
-      })
+      )
    })
  }

-  const originalGetOAuthRequestToken = oauth1Client.getOAuthRequestToken.bind(oauth1Client)
+  const originalGetOAuthRequestToken =
+    oauth1Client.getOAuthRequestToken.bind(oauth1Client)
  oauth1Client.getOAuthRequestToken = (params = {}) => {
    return new Promise((resolve, reject) => {
      // eslint-disable-next-line camelcase
-      originalGetOAuthRequestToken(params, (error, oauth_token, oauth_token_secret, params) => {
-        if (error) {
-          return reject(error)
+      originalGetOAuthRequestToken(
+        params,
+        (error, oauth_token, oauth_token_secret, params) => {
+          if (error) {
+            return reject(error)
+          }
+          resolve({ oauth_token, oauth_token_secret, params })
        }
-        resolve({ oauth_token, oauth_token_secret, params })
-      })
+      )
    })
  }
  return oauth1Client
@@ -104,103 +112,112 @@ export default function oAuthClient (provider) {
 * @param {import("types/providers").OAuthConfig} provider
 * @param {string | undefined} codeVerifier
 */
-async function getOAuth2AccessToken (code, provider, codeVerifier) {
+async function getOAuth2AccessToken(code, provider, codeVerifier) {
  const url = provider.accessTokenUrl
  const params = { ...provider.params }
  const headers = { ...provider.headers }
-  const codeParam = (params.grant_type === 'refresh_token') ? 'refresh_token' : 'code'
+  const codeParam =
+    params.grant_type === "refresh_token" ? "refresh_token" : "code"

-  if (!params[codeParam]) { params[codeParam] = code }
+  if (!params[codeParam]) {
+    params[codeParam] = code
+  }

-  if (!params.client_id) { params.client_id = provider.clientId }
+  if (!params.client_id) {
+    params.client_id = provider.clientId
+  }

  // For Apple the client secret must be generated on-the-fly.
  // Using the properties in clientSecret to create a JWT.
-  if (provider.id === 'apple' && typeof provider.clientSecret === 'object') {
+  if (provider.id === "apple" && typeof provider.clientSecret === "object") {
    const { keyId, teamId, privateKey } = provider.clientSecret
-    const clientSecret = jwtSign({
-      iss: teamId,
-      iat: Math.floor(Date.now() / 1000),
-      exp: Math.floor(Date.now() / 1000) + (86400 * 180), // 6 months
-      aud: 'https://appleid.apple.com',
-      sub: provider.clientId
-    },
-    // Automatically convert \\n into \n if found in private key. If the key
-    // is passed in an environment variable \n can get escaped as \\n
-    privateKey.replace(/\\n/g, '\n'),
-    { algorithm: 'ES256', keyid: keyId }
+    const clientSecret = jwtSign(
+      {
+        iss: teamId,
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor(Date.now() / 1000) + 86400 * 180, // 6 months
+        aud: "https://appleid.apple.com",
+        sub: provider.clientId,
+      },
+      // Automatically convert \\n into \n if found in private key. If the key
+      // is passed in an environment variable \n can get escaped as \\n
+      privateKey.replace(/\\n/g, "\n"),
+      { algorithm: "ES256", keyid: keyId }
    )
    params.client_secret = clientSecret
  } else {
    params.client_secret = provider.clientSecret
  }

-  if (!params.redirect_uri) { params.redirect_uri = provider.callbackUrl }
-
-  if (!headers['Content-Type']) { headers['Content-Type'] = 'application/x-www-form-urlencoded' }
-  // Added as a fix to accomodate change in Twitch OAuth API
-  if (!headers['Client-ID']) { headers['Client-ID'] = provider.clientId }
-  // Added as a fix for Reddit Authentication
-  if (provider.id === 'reddit') {
-    headers.Authorization = 'Basic ' + Buffer.from((provider.clientId + ':' + provider.clientSecret)).toString('base64')
+  if (!params.redirect_uri) {
+    params.redirect_uri = provider.callbackUrl
  }

-  if (provider.id === 'identity-server4' && !headers.Authorization) {
+  if (!headers["Content-Type"]) {
+    headers["Content-Type"] = "application/x-www-form-urlencoded"
+  }
+  // Added as a fix to accomodate change in Twitch OAuth API
+  if (!headers["Client-ID"]) {
+    headers["Client-ID"] = provider.clientId
+  }
+  // Added as a fix for Reddit Authentication
+  if (provider.id === "reddit") {
+    headers.Authorization =
+      "Basic " +
+      Buffer.from(provider.clientId + ":" + provider.clientSecret).toString(
+        "base64"
+      )
+  }
+
+  if (provider.id === "identity-server4" && !headers.Authorization) {
    headers.Authorization = `Bearer ${code}`
  }

-  if (provider.protection.includes('pkce')) {
+  if (provider.protection.includes("pkce")) {
    params.code_verifier = codeVerifier
  }

  const postData = querystring.stringify(params)

  return new Promise((resolve, reject) => {
-    this._request(
-      'POST',
-      url,
-      headers,
-      postData,
-      null,
-      (error, data, response) => {
-        if (error) {
-          logger.error('OAUTH_GET_ACCESS_TOKEN_ERROR', error, data, response)
+    this._request("POST", url, headers, postData, null, (error, data) => {
+      if (error) {
+        logger.error("OAUTH_GET_ACCESS_TOKEN_ERROR", error)
+        return reject(error)
+      }
+
+      let raw
+      try {
+        // As of http://tools.ietf.org/html/draft-ietf-oauth-v2-07
+        // responses should be in JSON
+        raw = JSON.parse(data)
+      } catch {
+        // However both Facebook + Github currently use rev05 of the spec  and neither
+        // seem to specify a content-type correctly in their response headers. :(
+        // Clients of these services suffer a minor performance cost.
+        raw = querystring.parse(data)
+      }
+
+      let accessToken
+      if (provider.id === "slack") {
+        const { ok, error } = raw
+        if (!ok) {
          return reject(error)
        }

-        let raw
-        try {
-          // As of http://tools.ietf.org/html/draft-ietf-oauth-v2-07
-          // responses should be in JSON
-          raw = JSON.parse(data)
-        } catch {
-          // However both Facebook + Github currently use rev05 of the spec  and neither
-          // seem to specify a content-type correctly in their response headers. :(
-          // Clients of these services suffer a minor performance cost.
-          raw = querystring.parse(data)
-        }
-
-        let accessToken
-        if (provider.id === 'slack') {
-          const { ok, error } = raw
-          if (!ok) {
-            return reject(error)
-          }
-
-          accessToken = raw.authed_user.access_token
-        } else {
-          accessToken = raw.access_token
-        }
-
-        resolve({
-          accessToken,
-          accessTokenExpires: null,
-          refreshToken: raw.refresh_token,
-          idToken: raw.id_token,
-          ...raw
-        })
+        accessToken = raw.authed_user.access_token
+      } else {
+        accessToken = raw.access_token
      }
-    )
+
+      resolve({
+        accessToken,
+        accessTokenExpires: null,
+        refreshToken: raw.refresh_token,
+        idToken: raw.id_token,
+        ...raw,
+      })
+    })
  })
 }

@@ -213,60 +230,69 @@ async function getOAuth2AccessToken (code, provider, codeVerifier) {
 * @param {string} accessToken
 * @param {any} results
 */
-async function getOAuth2 (provider, accessToken, results) {
+async function getOAuth2(provider, accessToken, results) {
  let url = provider.profileUrl
-  let httpMethod = 'GET'
+  let httpMethod = "GET"
  const headers = { ...provider.headers }

  if (this._useAuthorizationHeaderForGET) {
    headers.Authorization = this.buildAuthHeader(accessToken)

    // Mail.ru & vk.com require 'access_token' as URL request parameter
-    if (['mailru', 'vk'].includes(provider.id)) {
+    if (["mailru", "vk"].includes(provider.id)) {
      const safeAccessTokenURL = new URL(url)
-      safeAccessTokenURL.searchParams.append('access_token', accessToken)
+      safeAccessTokenURL.searchParams.append("access_token", accessToken)
      url = safeAccessTokenURL.href
    }

    // This line is required for Twitch
-    if (provider.id === 'twitch') {
-      headers['Client-ID'] = provider.clientId
+    if (provider.id === "twitch") {
+      headers["Client-ID"] = provider.clientId
    }
    accessToken = null
  }

-  if (provider.id === 'bungie') {
+  if (provider.id === "bungie") {
    url = prepareProfileUrl({ provider, url, results })
  }

  /** Dropbox requires POST instead of GET
   * Read more: https://www.dropbox.com/developers/reference/auth-types#user
   */
-  if (provider.id === 'dropbox') {
-    httpMethod = 'POST'
+  if (provider.id === "dropbox") {
+    httpMethod = "POST"
  }

  return new Promise((resolve, reject) => {
-    this._request(httpMethod, url, headers, null, accessToken, (error, profileData) => {
-      if (error) {
-        return reject(error)
+    this._request(
+      httpMethod,
+      url,
+      headers,
+      null,
+      accessToken,
+      (error, profileData) => {
+        if (error) {
+          return reject(error)
+        }
+        resolve(profileData)
      }
-      resolve(profileData)
-    })
+    )
  })
 }

 /** Bungie needs special handling */
-function prepareProfileUrl ({ provider, url, results }) {
+function prepareProfileUrl({ provider, url, results }) {
  if (!results.membership_id) {
    // internal error
    // @TODO: handle better
-    throw new Error('Expected membership_id to be passed.')
+    throw new Error("Expected membership_id to be passed.")
  }

-  if (!provider.headers?.['X-API-Key']) {
-    throw new Error('The Bungie provider requires the X-API-Key option to be present in "headers".')
+  if (!provider.headers?.["X-API-Key"]) {
+    throw new Error(
+      'The Bungie provider requires the X-API-Key option to be present in "headers".'
+    )
  }

-  return url.replace('{membershipId}', results.membership_id)
+  return url.replace("{membershipId}", results.membership_id)
 }
--- a/src/server/lib/oauth/pkce-handler.js
+++ b/src/server/lib/oauth/pkce-handler.js
@@ -36,7 +36,11 @@ export async function handleCallback (req, res) {
      pkceLength: PKCE_LENGTH,
      method: PKCE_CODE_CHALLENGE_METHOD
    })
-    cookie.set(res, cookies.pkceCodeVerifier.name, null, { maxAge: 0 }) // remove PKCE after it has been used
+    // remove PKCE after it has been used
+    cookie.set(res, cookies.pkceCodeVerifier.name, "", { 
+      ...cookies.pkceCodeVerifier.options,
+      maxAge: 0 
+    })
  } catch (error) {
    logger.error('CALLBACK_OAUTH_ERROR', error)
    return res.redirect(`${baseUrl}${basePath}/error?error=OAuthCallback`)
--- a/src/server/pages/signin.js
+++ b/src/server/pages/signin.js
@@ -1,12 +1,18 @@
-import { h } from 'preact' // eslint-disable-line no-unused-vars
+import { h } from "preact" // eslint-disable-line no-unused-vars

-export default function signin ({ csrfToken, providers, callbackUrl, email, error: errorType }) {
+export default function signin({
+  csrfToken,
+  providers,
+  callbackUrl,
+  email,
+  error: errorType,
+}) {
  // We only want to render providers
-  const providersToRender = providers.filter(provider => {
-    if (provider.type === 'oauth' || provider.type === 'email') {
+  const providersToRender = providers.filter((provider) => {
+    if (provider.type === "oauth" || provider.type === "email") {
      // Always render oauth and email type providers
      return true
-    } else if (provider.type === 'credentials' && provider.credentials) {
+    } else if (provider.type === "credentials" && provider.credentials) {
      // Only render credentials type provider if credentials are defined
      return true
    }
@@ -15,70 +21,93 @@ export default function signin ({ csrfToken, providers, callbackUrl, email, erro
  })

  const errors = {
-    Signin: 'Try signing with a different account.',
-    OAuthSignin: 'Try signing with a different account.',
-    OAuthCallback: 'Try signing with a different account.',
-    OAuthCreateAccount: 'Try signing with a different account.',
-    EmailCreateAccount: 'Try signing with a different account.',
-    Callback: 'Try signing with a different account.',
-    OAuthAccountNotLinked: 'To confirm your identity, sign in with the same account you used originally.',
-    EmailSignin: 'Check your email address.',
-    CredentialsSignin: 'Sign in failed. Check the details you provided are correct.',
-    default: 'Unable to sign in.'
+    Signin: "Try signing in with a different account.",
+    OAuthSignin: "Try signing in with a different account.",
+    OAuthCallback: "Try signing in with a different account.",
+    OAuthCreateAccount: "Try signing in with a different account.",
+    EmailCreateAccount: "Try signing in with a different account.",
+    Callback: "Try signing in with a different account.",
+    OAuthAccountNotLinked:
+      "To confirm your identity, sign in with the same account you used originally.",
+    EmailSignin: "Check your email inbox.",
+    CredentialsSignin:
+      "Sign in failed. Check the details you provided are correct.",
+    default: "Unable to sign in.",
  }

  const error = errorType && (errors[errorType] ?? errors.default)

  return (
-    <div className='signin'>
-      {error &&
-        <div className='error'>
+    <div className="signin">
+      {error && (
+        <div className="error">
          <p>{error}</p>
-        </div>}
-      {providersToRender.map((provider, i) =>
-        <div key={provider.id} className='provider'>
-          {provider.type === 'oauth' &&
-            <form action={provider.signinUrl} method='POST'>
-              <input type='hidden' name='csrfToken' value={csrfToken} />
-              {callbackUrl && <input type='hidden' name='callbackUrl' value={callbackUrl} />}
-              <button type='submit' className='button'>Sign in with {provider.name}</button>
-            </form>}
-          {(provider.type === 'email' || provider.type === 'credentials') && (i > 0) &&
-          providersToRender[i - 1].type !== 'email' && providersToRender[i - 1].type !== 'credentials' &&
-            <hr />}
-          {provider.type === 'email' &&
-            <form action={provider.signinUrl} method='POST'>
-              <input type='hidden' name='csrfToken' value={csrfToken} />
-              <label for={`input-email-for-${provider.id}-provider`}>Email</label>
-              <input id={`input-email-for-${provider.id}-provider`} autoFocus type='text' name='email' value={email} placeholder='email@example.com' />
-              <button type='submit'>Sign in with {provider.name}</button>
-            </form>}
-          {provider.type === 'credentials' &&
-            <form action={provider.callbackUrl} method='POST'>
-              <input type='hidden' name='csrfToken' value={csrfToken} />
-              {Object.keys(provider.credentials).map(credential => {
+        </div>
+      )}
+      {providersToRender.map((provider, i) => (
+        <div key={provider.id} className="provider">
+          {provider.type === "oauth" && (
+            <form action={provider.signinUrl} method="POST">
+              <input type="hidden" name="csrfToken" value={csrfToken} />
+              {callbackUrl && (
+                <input type="hidden" name="callbackUrl" value={callbackUrl} />
+              )}
+              <button type="submit" className="button">
+                Sign in with {provider.name}
+              </button>
+            </form>
+          )}
+          {(provider.type === "email" || provider.type === "credentials") &&
+            i > 0 &&
+            providersToRender[i - 1].type !== "email" &&
+            providersToRender[i - 1].type !== "credentials" && <hr />}
+          {provider.type === "email" && (
+            <form action={provider.signinUrl} method="POST">
+              <input type="hidden" name="csrfToken" value={csrfToken} />
+              <label for={`input-email-for-${provider.id}-provider`}>
+                Email
+              </label>
+              <input
+                id={`input-email-for-${provider.id}-provider`}
+                autoFocus
+                type="text"
+                name="email"
+                value={email}
+                placeholder="email@example.com"
+              />
+              <button type="submit">Sign in with {provider.name}</button>
+            </form>
+          )}
+          {provider.type === "credentials" && (
+            <form action={provider.callbackUrl} method="POST">
+              <input type="hidden" name="csrfToken" value={csrfToken} />
+              {Object.keys(provider.credentials).map((credential) => {
                return (
                  <div key={`input-group-${provider.id}`}>
                    <label
                      for={`input-${credential}-for-${provider.id}-provider`}
-                    >{provider.credentials[credential].label || credential}
+                    >
+                      {provider.credentials[credential].label || credential}
                    </label>
                    <input
                      name={credential}
                      id={`input-${credential}-for-${provider.id}-provider`}
-                      type={provider.credentials[credential].type || 'text'}
-                      value={provider.credentials[credential].value || ''}
-                      placeholder={provider.credentials[credential].placeholder || ''}
+                      type={provider.credentials[credential].type || "text"}
+                      value={provider.credentials[credential].value || ""}
+                      placeholder={
+                        provider.credentials[credential].placeholder || ""
+                      }
                    />
                  </div>
                )
              })}
-              <button type='submit'>Sign in with {provider.name}</button>
-            </form>}
-          {(provider.type === 'email' || provider.type === 'credentials') && ((i + 1) < providersToRender.length) &&
-            <hr />}
+              <button type="submit">Sign in with {provider.name}</button>
+            </form>
+          )}
+          {(provider.type === "email" || provider.type === "credentials") &&
+            i + 1 < providersToRender.length && <hr />}
        </div>
-      )}
+      ))}
    </div>
  )
 }
--- a/src/server/routes/signin.js
+++ b/src/server/routes/signin.js
@@ -8,14 +8,8 @@ import adapterErrorHandler from "../../adapters/error-handler"
 * @param {import("types/internals").NextAuthResponse} res
 */
 export default async function signin(req, res) {
-  const {
-    provider,
-    baseUrl,
-    basePath,
-    adapter,
-    callbacks,
-    logger,
-  } = req.options
+  const { provider, baseUrl, basePath, adapter, callbacks, logger } =
+    req.options

  if (!provider.type) {
    return res.status(500).end(`Error: Type not specified for ${provider.name}`)
@@ -46,6 +40,10 @@ export default async function signin(req, res) {
    // complains about this we can make strict RFC 2821 compliance an option.
    const email = req.body.email?.toLowerCase() ?? null

+    if (!email) {
+      return res.redirect(`${baseUrl}${basePath}/error?error=EmailSignin`)
+    }
+
    // If is an existing user return a user object (otherwise use placeholder)
    const profile = (await getUserByEmail(email)) || { email }
    const account = { id: provider.id, type: "email", providerAccountId: email }
--- a/types/index.d.ts
+++ b/types/index.d.ts
@@ -82,7 +82,7 @@ export interface NextAuthOptions {
   *     signOut: '/auth/signout',
   *     error: '/auth/error',
   *     verifyRequest: '/auth/verify-request',
-   *     newUser: null
+   *     newUser: '/auth/new-user'
   *   }
   * ```
   *
--- a/types/providers.d.ts
+++ b/types/providers.d.ts
@@ -1,5 +1,6 @@
 import { Profile, TokenSet, User } from "."
 import { Awaitable, NextApiRequest } from "./internals/utils"
+import { Options as SMTPConnectionOptions } from 'nodemailer/lib/smtp-connection'

 export type ProviderType = "oauth" | "email" | "credentials"

@@ -26,7 +27,7 @@ export interface OAuthConfig<P extends Record<string, unknown> = Profile>
  headers?: Record<string, any>
  type: "oauth"
  version: string
-  scope: string
+  scope: string | string[]
  params: { grant_type: string }
  accessTokenUrl: string
  requestTokenUrl?: string
@@ -71,6 +72,7 @@ export type OAuthProviderType =
  | "FACEIT"
  | "FortyTwo"
  | "Foursquare"
+  | "Freshbooks"
  | "FusionAuth"
  | "GitHub"
  | "GitLab"
@@ -83,8 +85,10 @@ export type OAuthProviderType =
  | "Mailchimp"
  | "MailRu"
  | "Medium"
+  | "Naver"
  | "Netlify"
  | "Okta"
+  | "OneLogin"
  | "Osso"
  | "Reddit"
  | "Salesforce"
@@ -120,23 +124,12 @@ interface CredentialsConfig<C extends Record<string, CredentialInput> = {}>
  authorize(credentials: Record<keyof C, string>, req: NextApiRequest): Awaitable<User | null>
 }

-export type CredentialsProvider = (
-  options: Partial<CredentialsConfig>
-) => CredentialsConfig
+export type CredentialsProvider = <C extends Record<string, CredentialInput>>(
+  options: Partial<CredentialsConfig<C>>
+) => CredentialsConfig<C>

 export type CredentialsProviderType = "Credentials"

-/** Email Provider */
-
-export interface EmailConfigServerOptions {
-  host: string
-  port: number
-  auth: {
-    user: string
-    pass: string
-  }
-}
-
 export type SendVerificationRequest = (params: {
  identifier: string
  url: string
@@ -148,7 +141,7 @@ export type SendVerificationRequest = (params: {
 export interface EmailConfig extends CommonProviderOptions {
  type: "email"
  // TODO: Make use of https://www.typescriptlang.org/docs/handbook/2/template-literal-types.html
-  server: string | EmailConfigServerOptions
+  server: string | SMTPConnectionOptions
  /** @default "NextAuth <no-reply@example.com>" */
  from?: string
  /**
--- a/types/tests/providers.test.ts
+++ b/types/tests/providers.test.ts
@@ -19,12 +19,12 @@ Providers.Email({
  from: "path/from",
 })

-// $ExpectType CredentialsConfig<{}>
+// $ExpectType CredentialsConfig<{ username: { label: string; type: string; }; password: { label: string; type: string; }; }>
 Providers.Credentials({
  id: "login",
  name: "account",
  credentials: {
-    user: {
+    username: {
      label: "Password",
      type: "password",
    },
@@ -33,7 +33,7 @@ Providers.Credentials({
      type: "password",
    },
  },
-  authorize: async (credentials) => {
+  authorize: async ({ username, password }) => {
    const user = {
      /* fetched user */
    }
@@ -152,6 +152,13 @@ Providers.Okta({
  domain: "https://foo.auth0.com",
 })

+// $ExpectType OAuthConfig<Profile>
+Providers.OneLogin({
+  clientId: "foo123",
+  clientSecret: "bar123",
+  domain: "foo.onelogin.com",
+})
+
 // $ExpectType OAuthConfig<Profile>
 Providers.BattleNet({
  clientId: "foo123",
@@ -257,3 +264,9 @@ Providers.Zoho({
  clientId: "foo123",
  clientSecret: "bar123",
 })
+
+// $ExpectType OAuthConfig<Profile>
+Providers.Freshbooks({
+  clientId: "foo123",
+  clientSecret: "bar123",
+})
--- a/www/docs/adapters/dynamodb.md
+++ b/www/docs/adapters/dynamodb.md
@@ -13,10 +13,10 @@ You can find the full schema in the table structure section below.

 ## Getting Started

-1. Install `next-auth` and `@next-auth/dynamodb-adapter@canary`
+1. Install `next-auth` and `@next-auth/dynamodb-adapter`

 ```js
-npm install next-auth @next-auth/dynamodb-adapter@canary
+npm install next-auth @next-auth/dynamodb-adapter
 ```

 2. Add this adapter to your `pages/api/auth/[...nextauth].js` next-auth configuration object.
--- a/www/docs/adapters/fauna.md
+++ b/www/docs/adapters/fauna.md
@@ -11,10 +11,10 @@ You can find the Fauna schema and seed information in the docs at [next-auth.js.

 ## Getting Started

-1. Install `next-auth` and `@next-auth/fauna-adapter@canary`
+1. Install `next-auth` and `@next-auth/fauna-adapter`

 ```js
-npm install next-auth @next-auth/fauna-adapter@canary
+npm install next-auth @next-auth/fauna-adapter
 ```

 2. Add this adapter to your `pages/api/[...nextauth].js` next-auth configuration object.
@@ -49,6 +49,8 @@ export default NextAuth({

 ## Schema

+Run the following commands inside of the `Shell` tab in the Fauna dashboard to setup the appropriate collections and indexes.
+
 ```javascript
 CreateCollection({ name: "accounts" })
 CreateCollection({ name: "sessions" })
@@ -76,7 +78,7 @@ CreateIndex({
  terms: [{ field: ["data", "email"] }],
 })
 CreateIndex({
-  name: "verification_request_by_token",
+  name: "verification_request_by_token_and_identifier",
  source: Collection("verification_requests"),
  unique: true,
  terms: [{ field: ["data", "token"] }, { field: ["data", "identifier"] }],
--- a/www/docs/adapters/firebase.md
+++ b/www/docs/adapters/firebase.md
@@ -9,13 +9,13 @@ This is the Firebase Adapter for [`next-auth`](https://next-auth.js.org). This p

 ## Getting Started

-1. Install `next-auth` and `@next-auth/firebase-adapter@canary`
+1. Install `next-auth` and `@next-auth/firebase-adapter`

 ```js
-npm install next-auth @next-auth/firebase-adapter@canary
+npm install next-auth @next-auth/firebase-adapter
 ```

-2. Add this adapter to your `pages/api/[...nextauth].js` next-auth configuration object.
+2. Add this adapter to your `pages/api/auth/[...nextauth].js` next-auth configuration object.

 ```javascript title="pages/api/auth/[...nextauth].js"
 import NextAuth from "next-auth"
--- a/www/docs/adapters/pouchdb.md
+++ b/www/docs/adapters/pouchdb.md
@@ -13,10 +13,10 @@ Depending on your architecture you can use PouchDB's http adapter to reach any d

 > **Prerequesite**: Your PouchDB instance MUST provide the `pouchdb-find` plugin since it is used internally by the adapter to build and manage indexes

-1. Install `next-auth` and `@next-auth/pouchdb-adapter@canary`
+1. Install `next-auth` and `@next-auth/pouchdb-adapter`

 ```js
-npm install next-auth @next-auth/pouchdb-adapter@canary
+npm install next-auth @next-auth/pouchdb-adapter
 ```

 2. Add this adapter to your `pages/api/auth/[...nextauth].js` next-auth configuration object
@@ -28,10 +28,9 @@ import { PouchDBAdapter } from "@next-auth/pouchdb-adapter"
 import PouchDB from "pouchdb"

 // Setup your PouchDB instance and database
-PouchDB
-  .plugin(require("pouchdb-adapter-leveldb"))   // Any other adapter
-  .plugin(require("pouchdb-find"))              // Don't forget the `pouchdb-find` plugin
-  
+PouchDB.plugin(require("pouchdb-adapter-leveldb")) // Any other adapter
+  .plugin(require("pouchdb-find")) // Don't forget the `pouchdb-find` plugin
+
 const pouchdb = new PouchDB("auth_db", { adapter: "leveldb" })

 // For more information on each option (and a full list of options) go to
@@ -49,7 +48,7 @@ export default NextAuth({
 })
 ```

-## Advanced 
+## Advanced

 ### Memory-First Caching Strategy

@@ -60,4 +59,3 @@ Use an in-memory PouchDB as your main authentication database, and synchronize i
 This will most likely not increase performance much in a serverless environment due to various reasons such as concurrency, function startup time increases, etc.

 For more details, please see https://pouchdb.com/api.html#sync
-
--- a/www/docs/adapters/prisma.md
+++ b/www/docs/adapters/prisma.md
@@ -11,10 +11,10 @@ You can also use NextAuth.js with the new experimental Adapter for [Prisma](http
 You may have noticed there is a `prisma` and `prisma-legacy` adapter. This is due to historical reasons, but the code has mostly converged so that there is no longer much difference between the two. The legacy adapter, however, does have the ability to rename tables which the newer version does not.
 :::

-To use this Adapter, you need to install Prisma Client, Prisma CLI, and the separate `@next-auth/prisma-adapter@canary` package:
+To use this Adapter, you need to install Prisma Client, Prisma CLI, and the separate `@next-auth/prisma-adapter` package:

 ```
-npm install @prisma/client @next-auth/prisma-adapter@canary
+npm install @prisma/client @next-auth/prisma-adapter
 npm install prisma --save-dev
 ```

--- a/www/docs/configuration/callbacks.md
+++ b/www/docs/configuration/callbacks.md
@@ -70,7 +70,7 @@ callbacks: {
  
  You can check for the `verificationRequest` property to avoid sending emails to addresses or domains on a blocklist (or to only explicitly generate them for email address in an allow list).

-* When using the **Credentials Provider** the `user` object is the response returned from the `authorization` callback and the `profile` object is the raw body of the `HTTP POST` submission.
+* When using the **Credentials Provider** the `user` object is the response returned from the `authorize` callback and the `profile` object is the raw body of the `HTTP POST` submission.

 :::note
 When using NextAuth.js with a database, the User object will be either a user object from the database (including the User ID) if the user has signed in before or a simpler prototype user object (i.e. name, email, image) for users who have not signed in before.
@@ -188,6 +188,8 @@ callbacks: {
 ...
 ```

+If you're using TypeScript, you will want to [augment the session type](/getting-started/typescript#module-augmentation).
+
 :::tip
 When using JSON Web Tokens the `jwt()` callback is invoked before the `session()` callback, so anything you add to the
 JSON Web Token will be immediately available in the session callback, like for example an `access_token` from a provider.
--- a/www/docs/configuration/options.md
+++ b/www/docs/configuration/options.md
@@ -123,27 +123,34 @@ jwt: {
  // Defaults to NextAuth.js secret if not explicitly specified.
  // This is used to generate the actual signingKey and produces a warning
  // message if not defined explicitly.
-  // secret: 'INp8IvdIyeMcoGAgFGoA61DdBglwwSqnXJZkgz8PSnw',
+  // You can generate a secret be using `openssl rand -base64 64`
+  secret: 'INp8IvdIyeMcoGAgFGoA61DdBglwwSqnXJZkgz8PSnw',
  // You can generate a signing key using `jose newkey -s 512 -t oct -a HS512`
  // This gives you direct knowledge of the key used to sign the token so you can use it
  // to authenticate indirectly (eg. to a database driver)
-  // signingKey: {"kty":"oct","kid":"Dl893BEV-iVE-x9EC52TDmlJUgGm9oZ99_ZL025Hc5Q","alg":"HS512","k":"K7QqRmJOKRK2qcCKV_pi9PSBv3XP0fpTu30TP8xn4w01xR3ZMZM38yL2DnTVPVw6e4yhdh0jtoah-i4c_pZagA"},
+  signingKey: {
+     kty: "oct",
+     kid: "Dl893BEV-iVE-x9EC52TDmlJUgGm9oZ99_ZL025Hc5Q",
+     alg: "HS512",
+     k: "K7QqRmJOKRK2qcCKV_pi9PSBv3XP0fpTu30TP8xn4w01xR3ZMZM38yL2DnTVPVw6e4yhdh0jtoah-i4c_pZagA"
+  },
  // If you chose something other than the default algorithm for the signingKey (HS512)
  // you also need to configure the algorithm
-  // verificationOptions: {
-  //    algorithms: ['HS256']
-  // },
+  verificationOptions: {
+     algorithms: ['HS256']
+  },
  // Set to true to use encryption. Defaults to false (signing only).
-  // encryption: true,
-  // encryptionKey: "",
-  // decryptionKey = encryptionKey,
-  // decryptionOptions = {
-  //    algorithms: ['A256GCM']
-  // },
+  encryption: true,
+  // You can generate an encryption key by using `npx node-jose-tools newkey -s 256 -t oct -a A256GCM -u enc`
+  encryptionKey: "",
+  // decryptionKey: encryptionKey,
+  decryptionOptions: {
+     algorithms: ['A256GCM']
+  },
  // You can define your own encode/decode functions for signing and encryption
  // if you want to override the default behaviour.
-  // async encode({ secret, token, maxAge }) {},
-  // async decode({ secret, token, maxAge }) {},
+  async encode({ secret, token, maxAge }) {},
+  async decode({ secret, token, maxAge }) {},
 }
 ```

@@ -229,7 +236,7 @@ pages: {
  signOut: '/auth/signout',
  error: '/auth/error', // Error code passed in query string as ?error=
  verifyRequest: '/auth/verify-request', // (used for check email message)
-  newUser: null // If set, new users will be directed here on first sign in
+  newUser: '/auth/new-user' // New users will be directed here on first sign in (leave the property out if not of interest)
 }
 ```

--- a/www/docs/configuration/pages.md
+++ b/www/docs/configuration/pages.md
@@ -16,7 +16,7 @@ To add a custom login page, you can use the `pages` option:
    signOut: '/auth/signout',
    error: '/auth/error', // Error code passed in query string as ?error=
    verifyRequest: '/auth/verify-request', // (used for check email message)
-    newUser: null // If set, new users will be directed here on first sign in
+    newUser: '/auth/new-user' // New users will be directed here on first sign in (leave the property out if not of interest)
  }
 ...
 ```
@@ -46,7 +46,7 @@ The following errors are passed as error query parameters to the default or over
 - **EmailSignin**: Sending the e-mail with the verification token failed
 - **CredentialsSignin**: The `authorize` callback returned `null` in the [Credentials provider](/providers/credentials). We don't recommend providing information about which part of the credentials were wrong, as it might be abused by malicious hackers.
 - **Default**: Catch all, will apply, if none of the above matched
-  
+
 Example: `/auth/error?error=Default`

 ## Theming
@@ -186,5 +186,5 @@ signIn('credentials', { username: 'jsmith', password: '1234' })
 ```

 :::tip
-Remember to put any custom pages in a folder outside **/pages/api** which is reserved for API code. As per the examples above, a location convention suggestion is `pages/auth/...`. 
+Remember to put any custom pages in a folder outside **/pages/api** which is reserved for API code. As per the examples above, a location convention suggestion is `pages/auth/...`.
 :::
--- a/www/docs/configuration/providers.md
+++ b/www/docs/configuration/providers.md
@@ -187,7 +187,7 @@ You only need to add two changes:
 2. Add provider documentation: [`www/docs/providers/{provider}.md`](https://github.com/nextauthjs/next-auth/tree/main/www/docs/providers)
 3. Add it to our [provider types](https://github.com/nextauthjs/next-auth/blob/main/types/providers.d.ts) (for TS projects)<br />
   • you just need to add your new provider name to [this list](https://github.com/nextauthjs/next-auth/blob/main/types/providers.d.ts#L56-L97)<br />
-   • in case you new provider accepts some custom options, you can [add them here](https://github.com/nextauthjs/next-auth/blob/main/types/providers.d.ts#L48-L53)
+   • in case your new provider accepts some custom options, you can [add them here](https://github.com/nextauthjs/next-auth/blob/main/types/providers.d.ts#L48-L53)

 That's it! 🎉 Others will be able to discover this provider much more easily now!

--- a/www/docs/faq.md
+++ b/www/docs/faq.md
@@ -23,13 +23,11 @@ You can use also NextAuth.js with any database using a custom database adapter,

 ### What authentication services does NextAuth.js support?

-
 <p>NextAuth.js includes built-in support for signing in with&nbsp;
 {Object.values(require("../providers.json")).sort().join(", ")}.
 (See also: <a href="/configuration/providers">Providers</a>)
 </p>

-
 NextAuth.js also supports email for passwordless sign in, which is useful for account recovery or for people who are not able to use an account with the configured OAuth services (e.g. due to service outage, account suspension or otherwise becoming locked out of an account).

 You can also use a custom based provider to support signing in with a username and password stored in an external database and/or using two factor authentication.
@@ -58,7 +56,6 @@ NextAuth.js is designed as a secure, confidential client and implements a server

 It is not intended to be used in native applications on desktop or mobile applications, which typically implement public clients (e.g. with client / secrets embedded in the application).

-
 ### Is NextAuth.js supporting TypeScript?

 Yes! Check out the [TypeScript docs](/getting-started/typescript)
@@ -83,9 +80,9 @@ If you are using a database with NextAuth.js, you can still explicitly enable JS

 ### Should I use a database?

-* Using NextAuth.js without a database works well for internal tools - where you need to control who is able to sign in, but when you do not need to create user accounts for them in your application.
+- Using NextAuth.js without a database works well for internal tools - where you need to control who is able to sign in, but when you do not need to create user accounts for them in your application.

-* Using NextAuth.js with a database is usually a better approach for a consumer facing application where you need to persist accounts (e.g. for billing, to contact customers, etc).
+- Using NextAuth.js with a database is usually a better approach for a consumer facing application where you need to persist accounts (e.g. for billing, to contact customers, etc).

 ### What database should I use?

@@ -93,16 +90,15 @@ Managed database solutions for MySQL, Postgres and MongoDB (and compatible datab

 If you are deploying directly to a particular cloud platform you may also want to consider serverless database offerings they have (e.g. [Amazon Aurora Serverless on AWS](https://aws.amazon.com/rds/aurora/serverless/)).

-
 ---

-## Security 
+## Security

 ### I think I've found a security problem, what should I do?

 Less serious or edge case issues (e.g. queries about compatibility with optional RFC specifications) can be raised as public issues on GitHub.

-If you discover what you think may be a potentially serious security problem, please contact a core team member via a private channel (e.g. via email to me@iaincollins.com) or raise a public issue requesting someone get in touch with you via whatever means you prefer for more details.
+If you discover what you think may be a potentially serious security problem, please contact a core team member via a private channel (e.g. via email to me@iaincollins.com or info@balazsorban.com and yo@ndo.dev) or raise a public issue requesting someone get in touch with you via whatever means you prefer for more details.

 ### What is the disclosure policy for NextAuth.js?

@@ -165,14 +161,14 @@ Ultimately if your request is not accepted or is not actively in development, yo

 ---

-## JSON Web Tokens 
+## JSON Web Tokens

 ### Does NextAuth.js use JSON Web Tokens?

 NextAuth.js supports both database session tokens and JWT session tokens.

-* If a database is specified, database session tokens will be used by default.
-* If no database is specified, JWT session tokens will be used by default.
+- If a database is specified, database session tokens will be used by default.
+- If no database is specified, JWT session tokens will be used by default.

 You can also choose to use JSON Web Tokens as session tokens with using a database, by explicitly setting the `session: { jwt: true }` option.

@@ -180,33 +176,33 @@ You can also choose to use JSON Web Tokens as session tokens with using a databa

 JSON Web Tokens can be used for session tokens, but are also used for lots of other things, such as sending signed objects between services in authentication flows.

-* Advantages of using a JWT as a session token include that they do not require a database to store sessions, this can be faster and cheaper to run and easier to scale.
+- Advantages of using a JWT as a session token include that they do not require a database to store sessions, this can be faster and cheaper to run and easier to scale.

-* JSON Web Tokens in NextAuth.js are secured using cryptographic signing (JWS) by default and it is easy for services and API endpoints to verify tokens without having to contact a database to verify them.
+- JSON Web Tokens in NextAuth.js are secured using cryptographic signing (JWS) by default and it is easy for services and API endpoints to verify tokens without having to contact a database to verify them.

-* You can enable encryption (JWE) to store include information directly in a JWT session token that you wish to keep secret and use the token to pass information between services / APIs on the same domain.
+- You can enable encryption (JWE) to store include information directly in a JWT session token that you wish to keep secret and use the token to pass information between services / APIs on the same domain.

-* You can use JWT to securely store information you do not mind the client knowing even without encryption, as the JWT is stored in a server-readable-only-token so data in the JWT is not accessible to third party JavaScript running on your site.
+- You can use JWT to securely store information you do not mind the client knowing even without encryption, as the JWT is stored in a server-readable-only-token so data in the JWT is not accessible to third party JavaScript running on your site.

 ### What are the disadvantages of JSON Web Tokens?

-* You cannot as easily expire a JSON Web Token - doing so requires maintaining a server side blocklist of invalid tokens (at least until they expire) and checking every token against the list every time a token is presented.
+- You cannot as easily expire a JSON Web Token - doing so requires maintaining a server side blocklist of invalid tokens (at least until they expire) and checking every token against the list every time a token is presented.

  Shorter session expiry times are used when using JSON Web Tokens as session tokens to allow sessions to be invalidated sooner and simplify this problem.

  NextAuth.js client includes advanced features to mitigate the downsides of using shorter session expiry times on the user experience, including automatic session token rotation, optionally sending keep alive messages to prevent short lived sessions from expiring if there is an window or tab open, background re-validation, and automatic tab/window syncing that keeps sessions in sync across windows any time session state changes or a window or tab gains or loses focus.

-* As with database session tokens, JSON Web Tokens are limited in the amount of data you can store in them. There is typically a limit of around 4096 bytes per cookie, though the exact limit varies between browsers, proxies and hosting services. If you want to support most browsers, then do not exceed 4096 bytes per cookie. If you want to save more data, you will need to persist your sessions in a database (Source: [browsercookielimits.iain.guru](http://browsercookielimits.iain.guru/))
+- As with database session tokens, JSON Web Tokens are limited in the amount of data you can store in them. There is typically a limit of around 4096 bytes per cookie, though the exact limit varies between browsers, proxies and hosting services. If you want to support most browsers, then do not exceed 4096 bytes per cookie. If you want to save more data, you will need to persist your sessions in a database (Source: [browsercookielimits.iain.guru](http://browsercookielimits.iain.guru/))

  The more data you try to store in a token and the more other cookies you set, the closer you will come to this limit. If you wish to store more than ~4 KB of data you're probably at the point where you need to store a unique ID in the token and persist the data elsewhere (e.g. in a server-side key/value store).

-* Data stored in an encrypted JSON Web Token (JWE) may be compromised at some point.
+- Data stored in an encrypted JSON Web Token (JWE) may be compromised at some point.

  Even if appropriately configured, information stored in an encrypted JWT should not be assumed to be impossible to decrypt at some point - e.g. due to the discovery of a defect or advances in technology.

  Avoid storing any data in a token that might be problematic if it were to be decrypted in the future.

-* If you do not explicitly specify a secret for for NextAuth.js, existing sessions will be invalidated any time your NextAuth.js configuration changes, as NextAuth.js will default to an auto-generated secret.
+- If you do not explicitly specify a secret for NextAuth.js, existing sessions will be invalidated any time your NextAuth.js configuration changes, as NextAuth.js will default to an auto-generated secret.

  If using JSON Web Token you should at least specify a secret and ideally configure public/private keys.

@@ -214,11 +210,11 @@ JSON Web Tokens can be used for session tokens, but are also used for lots of ot

 By default tokens are signed (JWS) but not encrypted (JWE), as encryption adds additional overhead and reduces the amount of space available to store data (total cookie size for a domain is limited to 4KB).

-* JSON Web Tokens in NextAuth.js use JWS and are signed using HS512 with an auto-generated key.
+- JSON Web Tokens in NextAuth.js use JWS and are signed using HS512 with an auto-generated key.

-* If encryption is enabled by setting `jwt: { encryption: true }` option then the JWT will _also_ use JWE to encrypt the token, using A256GCM with an auto-generated key.
+- If encryption is enabled by setting `jwt: { encryption: true }` option then the JWT will _also_ use JWE to encrypt the token, using A256GCM with an auto-generated key.

-You can specify other valid algorithms - [as specified in RFC 7518](https://tools.ietf.org/html/rfc7517) - with either a  secret (for symmetric encryption) or a public/private key pair (for a symmetric encryption).
+You can specify other valid algorithms - [as specified in RFC 7518](https://tools.ietf.org/html/rfc7517) - with either a secret (for symmetric encryption) or a public/private key pair (for a symmetric encryption).

 NextAuth.js will generate keys for you, but this will generate a warning at start up.

@@ -228,14 +224,14 @@ Using explicit public/private keys for signing is strongly recommended.

 NextAuth.js includes a largely complete implementation of JSON Object Signing and Encryption (JOSE):

-* [RFC 7515 - JSON Web Signature (JWS)](https://tools.ietf.org/html/rfc7515)
-* [RFC 7516 - JSON Web Encryption (JWE)](https://tools.ietf.org/html/rfc7516)
-* [RFC 7517 - JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517)
-* [RFC 7518 - JSON Web Algorithms (JWA)](https://tools.ietf.org/html/rfc7518)
-* [RFC 7519 - JSON Web Token (JWT)](https://tools.ietf.org/html/rfc7519)
+- [RFC 7515 - JSON Web Signature (JWS)](https://tools.ietf.org/html/rfc7515)
+- [RFC 7516 - JSON Web Encryption (JWE)](https://tools.ietf.org/html/rfc7516)
+- [RFC 7517 - JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517)
+- [RFC 7518 - JSON Web Algorithms (JWA)](https://tools.ietf.org/html/rfc7518)
+- [RFC 7519 - JSON Web Token (JWT)](https://tools.ietf.org/html/rfc7519)

 This incorporates support for:

-* [RFC 7638 - JSON Web Key Thumbprint](https://tools.ietf.org/html/rfc7638)
-* [RFC 7787 - JSON JWS Unencoded Payload Option](https://tools.ietf.org/html/rfc7797)
-* [RFC 8037 - CFRG Elliptic Curve ECDH and Signatures](https://tools.ietf.org/html/rfc8037)
+- [RFC 7638 - JSON Web Key Thumbprint](https://tools.ietf.org/html/rfc7638)
+- [RFC 7787 - JSON JWS Unencoded Payload Option](https://tools.ietf.org/html/rfc7797)
+- [RFC 8037 - CFRG Elliptic Curve ECDH and Signatures](https://tools.ietf.org/html/rfc8037)
--- a/www/docs/getting-started/client.md
+++ b/www/docs/getting-started/client.md
@@ -29,8 +29,8 @@ You can use the [session callback](/configuration/callbacks#session-callback) to

 ## useSession()

-* Client Side: **Yes**
-* Server Side: No
+- Client Side: **Yes**
+- Server Side: No

 The `useSession()` React Hook in the NextAuth.js client is the easiest way to check if someone is signed in.

@@ -39,12 +39,12 @@ It works best when the [`<Provider>`](#provider) is added to `pages/_app.js`.
 #### Example

 ```jsx
-import { useSession } from 'next-auth/client'
+import { useSession } from "next-auth/client"

 export default function Component() {
-  const [ session, loading ] = useSession()
+  const [session, loading] = useSession()

-  if(session) {
+  if (session) {
    return <p>Signed in as {session.user.email}</p>
  }

@@ -56,8 +56,8 @@ export default function Component() {

 ## getSession()

-* Client Side: **Yes**
-* Server Side: **Yes**
+- Client Side: **Yes**
+- Server Side: **Yes**

 NextAuth.js provides a `getSession()` method which can be called client or server side to return a session.

@@ -75,7 +75,7 @@ async function myFunction() {
 #### Server Side Example

 ```js
-import { getSession } from 'next-auth/client'
+import { getSession } from "next-auth/client"

 export default async (req, res) => {
  const session = await getSession({ req })
@@ -94,8 +94,8 @@ The tutorial [securing pages and API routes](/tutorials/securing-pages-and-api-r

 ## getCsrfToken()

-* Client Side: **Yes**
-* Server Side: **Yes**
+- Client Side: **Yes**
+- Server Side: **Yes**

 The `getCsrfToken()` method returns the current Cross Site Request Forgery Token (CSRF Token) required to make POST requests (e.g. for signing in and signing out).

@@ -113,7 +113,7 @@ async function myFunction() {
 #### Server Side Example

 ```js
-import { getCsrfToken } from 'next-auth/client'
+import { getCsrfToken } from "next-auth/client"

 export default async (req, res) => {
  const csrfToken = await getCsrfToken({ req })
@@ -126,8 +126,8 @@ export default async (req, res) => {

 ## getProviders()

-* Client Side: **Yes**
-* Server Side: **Yes**
+- Client Side: **Yes**
+- Server Side: **Yes**

 The `getProviders()` method returns the list of providers currently configured for sign in.

@@ -140,11 +140,11 @@ It can be useful if you are creating a dynamic custom sign in page.
 #### API Route

 ```jsx title="pages/api/example.js"
-import { getProviders } from 'next-auth/client'
+import { getProviders } from "next-auth/client"

 export default async (req, res) => {
  const providers = await getProviders()
-  console.log('Providers', providers)
+  console.log("Providers", providers)
  res.end()
 }
 ```
@@ -157,8 +157,8 @@ Unlike `getSession()` and `getCsrfToken()`, when calling `getProviders()` server

 ## signIn()

-* Client Side: **Yes**
-* Server Side: No
+- Client Side: **Yes**
+- Server Side: No

 Using the `signIn()` method ensures the user ends back on the page they started on after completing a sign in flow. It will also handle CSRF Tokens for you automatically when signing in with email.

@@ -167,20 +167,18 @@ The `signIn()` method can be called from the client in different ways, as shown
 #### Redirects to sign in page when clicked

 ```js
-import { signIn } from 'next-auth/client'
+import { signIn } from "next-auth/client"

-export default () => (
-  <button onClick={() => signIn()}>Sign in</button>
-)
+export default () => <button onClick={() => signIn()}>Sign in</button>
 ```

 #### Starts Google OAuth sign-in flow when clicked

 ```js
-import { signIn } from 'next-auth/client'
+import { signIn } from "next-auth/client"

 export default () => (
-  <button onClick={() => signIn('google')}>Sign in with Google</button>
+  <button onClick={() => signIn("google")}>Sign in with Google</button>
 )
 ```

@@ -189,10 +187,10 @@ export default () => (
 When using it with the email flow, pass the target `email` as an option.

 ```js
-import { signIn } from 'next-auth/client'
+import { signIn } from "next-auth/client"

 export default ({ email }) => (
-  <button onClick={() => signIn('email', { email })}>Sign in with Email</button>
+  <button onClick={() => signIn("email", { email })}>Sign in with Email</button>
 )
 ```

@@ -204,9 +202,9 @@ You can specify a different `callbackUrl` by specifying it as the second argumen

 e.g.

-* `signIn(null, { callbackUrl: 'http://localhost:3000/foo' })`
-* `signIn('google', { callbackUrl: 'http://localhost:3000/foo' })`
-* `signIn('email', { email, callbackUrl: 'http://localhost:3000/foo' })`
+- `signIn(null, { callbackUrl: 'http://localhost:3000/foo' })`
+- `signIn('google', { callbackUrl: 'http://localhost:3000/foo' })`
+- `signIn('email', { email, callbackUrl: 'http://localhost:3000/foo' })`

 The URL must be considered valid by the [redirect callback handler](/configuration/callbacks#redirect-callback). By default it requires the URL to be an absolute URL at the same hostname, or else it will redirect to the homepage. You can define your own [redirect callback](/configuration/callbacks#redirect-callback) to allow other URLs, including supporting relative URLs.

@@ -234,8 +232,8 @@ e.g.
  error: string | undefined
  /**
   * HTTP status code,
-   * hints the kind of error that happened. 
-   */ 
+   * hints the kind of error that happened.
+   */
  status: number
  /**
   * `true` if the signin was successful
@@ -258,8 +256,8 @@ See the [Authorization Request OIDC spec](https://openid.net/specs/openid-connec

 e.g.

-* `signIn("identity-server4", null, { prompt: "login" })` *always ask the user to reauthenticate*
-* `signIn("auth0", null, { login_hint: "info@example.com" })` *hints the e-mail address to the provider*
+- `signIn("identity-server4", null, { prompt: "login" })` _always ask the user to reauthenticate_
+- `signIn("auth0", null, { login_hint: "info@example.com" })` _hints the e-mail address to the provider_

 :::note
 You can also set these parameters through [`provider.authorizationParams`](/configuration/providers#oauth-provider-options).
@@ -273,19 +271,17 @@ The following parameters are always overridden server-side: `redirect_uri`, `sta

 ## signOut()

-* Client Side: **Yes**
-* Server Side: No
+- Client Side: **Yes**
+- Server Side: No

-Using the `signOut()` method ensures the user ends back on the page they started on after completing the sign out flow. It also handles CSRF tokens for you automatically.
+In order to logout, use the `signOut()` method to ensure the user ends back on the page they started on after completing the sign out flow. It also handles CSRF tokens for you automatically.

 It reloads the page in the browser when complete.

 ```js
-import { signOut } from 'next-auth/client'
+import { signOut } from "next-auth/client"

-export default () => (
-  <button onClick={() => signOut()}>Sign out</button>
-)
+export default () => <button onClick={() => signOut()}>Sign out</button>
 ```

 #### Specifying a callbackUrl
@@ -315,9 +311,9 @@ Using the supplied React `<Provider>` allows instances of `useSession()` to shar
 This improves performance, reduces network calls and avoids page flicker when rendering. It is highly recommended and can be easily added to all pages in Next.js apps by using `pages/_app.js`.

 ```jsx title="pages/_app.js"
-import { Provider } from 'next-auth/client'
+import { Provider } from "next-auth/client"

-export default function App ({ Component, pageProps }) {
+export default function App({ Component, pageProps }) {
  return (
    <Provider session={pageProps.session}>
      <Component {...pageProps} />
@@ -350,21 +346,22 @@ If every one of your pages needs to be protected, you can do this in `_app`, oth

 The session state is automatically synchronized across all open tabs/windows and they are all updated whenever they gain or lose focus or the state changes in any of them (e.g. a user signs in or out).

-If you have session expiry times of 30 days (the default) or more then you probably don't need to change any of the default options in the Provider. If you need to, you can can trigger an update of the session object across all tabs/windows by calling `getSession()` from a client side function.
+If you have session expiry times of 30 days (the default) or more then you probably don't need to change any of the default options in the Provider. If you need to, you can trigger an update of the session object across all tabs/windows by calling `getSession()` from a client side function.

 However, if you need to customise the session behaviour and/or are using short session expiry times, you can pass options to the provider to customise the behaviour of the `useSession()` hook.

 ```jsx title="pages/_app.js"
-import { Provider } from 'next-auth/client'
+import { Provider } from "next-auth/client"

-export default function App ({ Component, pageProps }) {
+export default function App({ Component, pageProps }) {
  return (
-    <Provider session={pageProps.session}
-      options={{ 
-        clientMaxAge: 60     // Re-fetch session if cache is older than 60 seconds
-        keepAlive:    5 * 60 // Send keepAlive message every 5 minutes
+    <Provider
+      session={pageProps.session}
+      options={{
+        clientMaxAge: 60, // Re-fetch session if cache is older than 60 seconds
+        keepAlive: 5 * 60, // Send keepAlive message every 5 minutes
      }}
-      >
+    >
      <Component {...pageProps} />
    </Provider>
  )
@@ -376,7 +373,7 @@ export default function App ({ Component, pageProps }) {

 Every tab/window maintains its own copy of the local session state; the session is not stored in shared storage like localStorage or sessionStorage. Any update in one tab/window triggers a message to other tabs/windows to update their own session state.

-Using low values for `clientMaxAge` or `keepAlive` will increase network traffic and load on  authenticated clients and may impact hosting costs and performance.
+Using low values for `clientMaxAge` or `keepAlive` will increase network traffic and load on authenticated clients and may impact hosting costs and performance.
 :::

 #### Client Max Age
@@ -402,7 +399,7 @@ If set to any value other than zero, it specifies in seconds how often the clien
 The value for `keepAlive` should always be lower than the value of the session `maxAge` option.

 :::note
-See [**the Next.js documentation**](https://nextjs.org/docs/advanced-features/custom-app) for more information on **_app.js** in Next.js applications.
+See [**the Next.js documentation**](https://nextjs.org/docs/advanced-features/custom-app) for more information on **\_app.js** in Next.js applications.
 :::

 ## Alternatives
@@ -412,8 +409,8 @@ See [**the Next.js documentation**](https://nextjs.org/docs/advanced-features/cu
 Due to the way Next.js handles `getServerSideProps` / `getInitialProps`, every protected page load has to make a server-side query to check if the session is valid and then generate the requested page. This alternative solution allows for showing a loading state on the initial check and every page transition afterward will be client-side, without having to check with the server and regenerate pages.

 ```js title="pages/admin.jsx"
-export default function AdminDashboard () {
-  const [session] = useSession() 
+export default function AdminDashboard() {
+  const [session] = useSession()
  // session is always non-null inside this page, all the way down the React tree.
  return "Some super secret dashboard"
 }
@@ -424,12 +421,15 @@ AdminDashboard.auth = true
 ```jsx title="pages/_app.jsx"
 export default function App({ Component, pageProps }) {
  return (
-    <SessionProvider session={pageProps.session}>
-      {Component.auth
-        ? <Auth><Component {...pageProps} /></Auth>
-        : <Component {...pageProps} />
-      }
-    </SessionProvider>
+    <Provider session={pageProps.session}>
+      {Component.auth ? (
+        <Auth>
+          <Component {...pageProps} />
+        </Auth>
+      ) : (
+        <Component {...pageProps} />
+      )}
+    </Provider>
  )
 }

@@ -444,7 +444,7 @@ function Auth({ children }) {
  if (isUser) {
    return children
  }
-  
+
  // Session is being fetched, or no user.
  // If no user, useEffect() will redirect.
  return <div>Loading...</div>
@@ -456,20 +456,19 @@ It can be easily be extended/modified to support something like an options objec
 ```jsx title="pages/admin.jsx"
 AdminDashboard.auth = {
  role: "admin",
-  loading: <AdminLoadingSkeleton/>,
-  unauthorized: "/login-with-different-user" // redirect to this url
+  loading: <AdminLoadingSkeleton />,
+  unauthorized: "/login-with-different-user", // redirect to this url
 }
 ```

-Because of how _app is done, it won't unnecessarily contact the /api/auth/session endpoint for pages that do not require auth.
+Because of how \_app is done, it won't unnecessarily contact the /api/auth/session endpoint for pages that do not require auth.

 More information can be found in the following [Github Issue](https://github.com/nextauthjs/next-auth/issues/1210).

 ### NextAuth.js + React-Query

-There is also an alternative client-side API library based upon [`react-query`](https://www.npmjs.com/package/react-query) available under [`nextauthjs/react-query`](https://github.com/nextauthjs/react-query). 
+There is also an alternative client-side API library based upon [`react-query`](https://www.npmjs.com/package/react-query) available under [`nextauthjs/react-query`](https://github.com/nextauthjs/react-query).

 If you use `react-query` in your project already, you can leverage it with NextAuth.js to handle the client-side session management for you as well. This replaces NextAuth.js's native `useSession` and `Provider` from `next-auth/client`.

 See repository [`README`](https://github.com/nextauthjs/react-query) for more details.
-
--- a/www/docs/providers/azure-ad-b2c.md
+++ b/www/docs/providers/azure-ad-b2c.md
@@ -5,11 +5,11 @@ title: Azure Active Directory B2C

 ## Documentation

-https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow
+https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow

 ## Configuration

-https://docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-tenant
+https://docs.microsoft.com/azure/active-directory-b2c/tutorial-create-tenant

 ## Options

--- a/www/docs/providers/email.md
+++ b/www/docs/providers/email.md
@@ -13,7 +13,7 @@ The Email provider can be used in conjunction with (or instead of) one or more O

 ### How it works

-On initial sign in, a **Verification Token** is sent to the email address provided. By default this token is valid for 24 hours. If the Verification Token is used with that time (i.e. by clicking on the link in the email) an account is created for the user and they are signed in.
+On initial sign in, a **Verification Token** is sent to the email address provided. By default this token is valid for 24 hours. If the Verification Token is used within that time (i.e. by clicking on the link in the email) an account is created for the user and they are signed in.

 If someone provides the email address of an _existing account_ when signing in, an email is sent and they are signed into the account associated with that email address when they follow the link in the email.

@@ -187,7 +187,7 @@ const html = ({ url, site, email }) => {
      <td align="center" style="padding: 20px 0;">
        <table border="0" cellspacing="0" cellpadding="0">
          <tr>
-            <td align="center" style="border-radius: 5px;" bgcolor="${buttonBackgroundColor}"><a href="${url}" target="_blank" style="font-size: 18px; font-family: Helvetica, Arial, sans-serif; color: ${buttonTextColor}; text-decoration: none; text-decoration: none;border-radius: 5px; padding: 10px 20px; border: 1px solid ${buttonBorderColor}; display: inline-block; font-weight: bold;">Sign in</a></td>
+            <td align="center" style="border-radius: 5px;" bgcolor="${buttonBackgroundColor}"><a href="${url}" target="_blank" style="font-size: 18px; font-family: Helvetica, Arial, sans-serif; color: ${buttonTextColor}; text-decoration: none; border-radius: 5px; padding: 10px 20px; border: 1px solid ${buttonBorderColor}; display: inline-block; font-weight: bold;">Sign in</a></td>
          </tr>
        </table>
      </td>
--- a/www/docs/providers/freshbooks.md
+++ b/www/docs/providers/freshbooks.md
@@ -0,0 +1,33 @@
+---
+id: freshbooks
+title: Freshbooks
+---
+
+## Documentation
+
+https://www.freshbooks.com/api/authenticating-with-oauth-2-0-on-the-new-freshbooks-api
+
+## Configuration
+
+https://my.freshbooks.com/#/developer
+
+## Options
+
+The Freshbooks Provider comes with a set of default options:
+
+https://www.freshbooks.com/api/start
+
+You can override any of the options to suit your own use case.
+## Example
+
+```js
+import Providers from `next-auth/providers`
+...
+providers: [
+  Providers.Freshbooks({
+    clientId: process.env.FRESHBOOKS_CLIENT_ID,
+    clientSecret: process.env.FRESHBOOKS_CLIENT_SECRET,
+  })
+]
+...
+```
--- a/www/docs/providers/google.md
+++ b/www/docs/providers/google.md
@@ -34,7 +34,7 @@ providers: [
 ```

 :::warning
-Google only provide the Refresh Token to an application the first time a user signs in.
+Google only provides Refresh Token to an application the first time a user signs in.

 To force Google to re-issue a Refresh Token, the user needs to remove the application from their account and sign in again:
 https://myaccount.google.com/permissions
--- a/www/docs/providers/linkedin.md
+++ b/www/docs/providers/linkedin.md
@@ -19,7 +19,7 @@ From the Auth tab get the client ID and client secret. On the same tab, add redi

 The **LinkedIn Provider** comes with a set of default options:

- [LinkedIn Provider options](https://github.com/nextauthjs/next-auth/blob/main/src/providers/linked-in.js)
+- [LinkedIn Provider options](https://github.com/nextauthjs/next-auth/blob/main/src/providers/linkedin.js)

 You can override any of the options to suit your own use case.

--- a/www/docs/providers/naver.md
+++ b/www/docs/providers/naver.md
@@ -0,0 +1,34 @@
+---
+id: naver
+title: Naver
+---
+
+## Documentation
+
+https://developers.naver.com/docs/login/overview/overview.md
+
+## Configuration
+
+https://developers.naver.com/docs/login/api/api.md
+
+## Options
+
+The **Naver Provider** comes with a set of default options:
+
+- [Naver Provider options](https://github.com/nextauthjs/next-auth/blob/main/src/providers/naver.js)
+
+You can override any of the options to suit your own use case.
+
+## Example
+
+```js
+import Providers from `next-auth/providers`
+...
+providers: [
+  Providers.Naver({
+    clientId: process.env.NAVER_CLIENT_ID,
+    clientSecret: process.env.NAVER_CLIENT_SECRET
+  })
+]
+...
+```
--- a/www/docs/providers/onelogin.md
+++ b/www/docs/providers/onelogin.md
@@ -0,0 +1,31 @@
+---
+id: onelogin
+title: OneLogin
+---
+
+## Documentation
+
+https://developers.onelogin.com/openid-connect
+
+## Options
+
+The **OneLogin Provider** comes with a set of default options:
+
+- [OneLogin Provider options](https://github.com/nextauthjs/next-auth/blob/main/src/providers/onelogin.js)
+
+You can override any of the options to suit your own use case.
+
+## Example
+
+```js
+import Providers from `next-auth/providers`
+...
+providers: [
+  Providers.OneLogin({
+    clientId: process.env.ONELOGIN_CLIENT_ID,
+    clientSecret: process.env.ONELOGIN_CLIENT_SECRET,
+    domain: process.env.ONELOGIN_DOMAIN
+  })
+]
+...
+```
--- a/www/docs/tutorials.md
+++ b/www/docs/tutorials.md
@@ -94,3 +94,7 @@ This tutorial walks step by step on how to get Sign In with Apple working (both
 ### [How to Authenticate Next.js Apps with Twitter & NextAuth.js](https://spacejelly.dev/posts/how-to-authenticate-next-js-apps-with-twitter-nextauth-js/)

 Learn how to add Twitter authentication and login to a Next.js app both clientside and serverside with NextAuth.js.
+
+### [Using NextAuth.js with Magic links](https://dev.to/narciero/using-nextauth-js-with-magic-links-df4)
+
+Learn how to use [Magic](https://magic.link) link authentication with [NextAuth.js](https://next-auth.js.org) to enable passwordless authentication without a database.
--- a/www/docs/tutorials/typeorm-custom-models.md
+++ b/www/docs/tutorials/typeorm-custom-models.md
@@ -48,7 +48,7 @@ export default {
 ```

 :::note
-[View source for built-in TypeORM models and schemas](https://github.com/nextauthjs/adapters/tree/canary/packages/typeorm-legacy/src/models)
+[View source for built-in TypeORM models and schemas](https://github.com/nextauthjs/adapters/tree/main/packages/typeorm-legacy/src/models)
 :::

 ## Using custom models
--- a/www/docusaurus.config.js
+++ b/www/docusaurus.config.js
@@ -42,12 +42,12 @@ module.exports = {
          position: "left",
        },
        {
-          href: "https://www.npmjs.com/package/next-auth",
+          to: "https://www.npmjs.com/package/next-auth",
          label: "npm",
          position: "right",
        },
        {
-          href: "https://github.com/nextauthjs/next-auth",
+          to: "https://github.com/nextauthjs/next-auth",
          label: "GitHub",
          position: "right",
        },
@@ -69,12 +69,8 @@ module.exports = {
              to: "/getting-started/introduction",
            },
            {
-              label: "Contributors",
-              to: "/contributors",
-            },
-            {
-              label: "Canary documentation",
-              to: "https://next-auth-git-canary.nextauthjs.vercel.app/",
+              label: "Next documentation",
+              to: "https://next-auth-git-next.nextauthjs.vercel.app",
            },
          ],
        },
@@ -95,8 +91,12 @@ module.exports = {
          title: "Acknowledgements",
          items: [
            {
-              label: "Docusaurus",
-              to: "https://v2.docusaurus.io/",
+              label: "Contributors",
+              to: "/contributors",
+            },
+            {
+              label: "Sponsors",
+              to: "https://opencollective.com/nextauth",
            },
            {
              label: "Images by unDraw",
@@ -118,6 +118,13 @@ module.exports = {
      ],
      copyright: "NextAuth.js &copy; Iain Collins 2021",
    },
+    colorMode: {
+      respectPrefersColorScheme: true,
+      switchConfig: {
+        darkIcon: "🌑",
+        lightIcon: "💡",
+      },
+    },
  },
  presets: [
    [
Author	SHA1	Message	Date
Balázs Orbán	29db75ad28	chore(release): bump version [skip ci]	2022-07-25 12:31:40 +02:00
Balázs Orbán	d348ca1dc1	fix: reduce `logger.error` context	2022-07-25 11:14:49 +02:00
Balázs Orbán	d53e1ea6c4	chore: gitignore v4 files	2022-07-25 11:13:44 +02:00
Balázs Orbán	e701342b1a	update package-lock.json	2022-07-05 13:49:23 +02:00
Balázs Orbán	8a133bf5fd	fix: don't render email in email's HTML body	2022-07-05 13:47:28 +02:00
Balázs Orbán	35a3ea6620	fix: handle invalid email	2022-07-01 12:42:20 +02:00
Balázs Orbán	289800fbb4	chore: bump version	2022-06-23 12:05:39 +02:00
Sylvain Bellone	28eccc3e64	fix: ReferenceError: defaultCookies is not defined (#4711 )	2022-06-23 10:50:28 +02:00
Balázs Orbán	e16bf939a9	chore: bump version	2022-06-20 10:07:04 +02:00
Balázs Orbán	9b078c92b2	fix: don't show error on relative `callbackUrl`	2022-06-20 10:05:36 +02:00
Balázs Orbán	87f6f576b1	fix: handle invalid `callbackUrl`	2022-06-10 15:11:41 +02:00
Balázs Orbán	50584bdc4c	chore: bump version	2022-04-26 12:22:45 +02:00
Balázs Orbán	b4429235c0	fix: more strict default callback url handling	2022-04-26 12:22:11 +02:00
Balázs Orbán	e1b297d06d	fix: update default `callbacks.redirect`	2022-04-14 11:32:16 +02:00
Balázs Orbán	ab764e3793	chore: bump release	2022-03-15 22:50:13 +01:00
Balázs Orbán	c8941e4b3e	fix: remove `action` from bad request response	2022-03-15 22:45:10 +01:00
Nico Domino	ead715219a	fix(deps): update built-in adapter dependencies (#2589 ) * fix(deps): update prisma-legacy-adapter and typeorm-legacy-adapter dependencies * chore: add missing package-lock update	2021-08-23 21:55:33 +02:00
Ashutosh Kumar	8faa7553dd	docs: add suggestions for secret and encryption key generation (#2578 )	2021-08-21 23:08:56 +02:00
Eduard Babinyan	90a6a0084b	feat(provider): return image for Yandex by default (#2563 ) Uploading an user image.	2021-08-20 09:37:30 +02:00
Aaron Powell	cb844a2436	docs(provider): remove en-us from Azure urls (#2554 ) MS Docs has a lot of local language translations, so it's best to remove locale information from the URLs so that when someone follows them, they land on the right language version of the content.	2021-08-18 09:46:32 +02:00
Sercan Altundas	74558d6cc2	docs(email): remove duplicate CSS property from html (#2546 ) - The CSS property 'text-decoration: none;' was duplicated in the example html code and is removed.	2021-08-17 12:17:54 +02:00
Jaye Hackett	d03125a77b	docs(ts): mention module augmentation on callbacks (#2541 )	2021-08-17 01:01:19 +02:00
Liam Tait	66d16f8bf4	fix(ts): allow `scope` as string array type (#2511 )	2021-08-12 17:51:31 +02:00
Nico Domino	be74dd0e7e	docs(security): email contact update (#2467 ) * chore(docs): email contact update * chore(docs): add me@iaincollins.com back	2021-08-02 17:18:17 +02:00
Aryan Beezadhur	9bf867ddcf	docs: Update faq.md (#2458 )	2021-07-30 22:34:32 +02:00
Nico Domino	0f460c22da	docs(client): add text regarding 'logout' (#2432 )	2021-07-28 20:10:08 +02:00
Sigurd Heggemsnes	887cb00877	docs(adapter): Typo in filepath for firebase auth in docs. (#2436 )	2021-07-28 12:48:47 +02:00
Douglas	75ca097ff7	docs: Fix link to code (#2405 )	2021-07-19 15:36:37 +02:00
Nicolas Azari	bcb9383aec	docs: fix typos in options.md (#2393 ) * Update options.md * Update www/docs/configuration/options.md Co-authored-by: Balázs Orbán <info@balazsorban.com> Co-authored-by: Balázs Orbán <info@balazsorban.com>	2021-07-17 22:21:45 +02:00
John Michael Kuhn Jr	b953963101	chore(core): fix typo in csrf-token-handler.js where 'strategy' is misspelled (#2391 )	2021-07-17 12:02:38 +02:00
Nico Domino	4649f1968b	docs(readme): add opencollective details to readme (#2388 ) * docs(readme): add opencollective details to readme * docs(www): add sponsors to docs footer * docs(readme): move support under ack * docs(www): dropped docusaurus link in footer	2021-07-16 18:05:15 +02:00
Angelo Annunziata	45f4a69a4e	docs(configuration): remove comments in JWT example (#2378 )	2021-07-16 09:28:19 +02:00
Prabhdeep Singh	2155c93a3c	feat(providers): add OneLogin (#2345 ) Co-authored-by: Lluis Agusti <hi@llu.lu>	2021-07-14 11:07:56 +02:00
Angelo Annunziata	d5958571a4	docs(provider): fix typo (#2369 )	2021-07-13 21:36:00 +02:00
James Q Quick	ebecaa6a4b	docs(adapter): match Fauna index name with implementation(#2360 ) * Update Fauna Adapter - added one-liner to explain how to use the setup scripts inside of the Fauna dashboard - updated the `verification_request_by_token` index name to match what is expected inside of the SDK which is `verification_request_by_token_and_identifier` * Update Typo Co-authored-by: Balázs Orbán <info@balazsorban.com> Co-authored-by: Balázs Orbán <info@balazsorban.com>	2021-07-13 17:58:58 +02:00
Vincent Grafé	1c5173a818	docs(callbacks): fix typo (#2363 )	2021-07-13 10:24:05 +02:00
Ben Goshow	35ce332cc6	feat(providers): add Freshbooks (#2322 ) Contains the following squashed commits: * Create freshbooks.js * Create freshbooks.md * Update providers.d.ts * Update freshbooks.md * Update src/providers/freshbooks.js * Update providers.test.ts * Update freshbooks.md	2021-07-11 20:25:26 +02:00
Imamuzzaki Abu Salam	ec295287f1	docs: delete can word in "can can" (#2348 )	2021-07-11 15:08:05 +02:00
Nick Arciero	46978ac02f	docs(tutorial): Add link to blog post about integrating with `Magic` (#2340 )	2021-07-10 09:56:13 +02:00
Pol	f546e550dd	fix(oauth): correctly remove `code_verifier` cookie when used (#2325 ) Co-authored-by: Pol Bonastre <pbonastre@plainconcepts.com>	2021-07-08 17:24:56 +02:00
Balázs Orbán	ac5b4db0f2	chore: add OpenCollective link to FUNDING.yml	2021-07-05 17:54:34 +02:00
Mahieyin Rahmun	8bbffdd08c	docs(github): remove title property (#2308 )	2021-07-04 13:23:44 +02:00
Mahieyin Rahmun	a22a0a36fd	docs(github): remove title prefix and make reproductions required (#2306 )	2021-07-04 11:19:13 +02:00
Mahieyin Rahmun	797272afe1	docs: use issue template forms (#2274 ) * (docs) initial issue template forms as per #2271 * (typo) fix grammar and typo * (forms) make the requested changes * (chore) delete the old .md files * (forms) fix type key	2021-07-02 21:13:03 +02:00
Mahieyin Rahmun	13e56bcf2f	docs(adapters): update outdated documentation (#2296 )	2021-07-02 12:50:27 +02:00
yokinist	b0f7f87c04	docs: update 'pages' option in example code (#2270 )	2021-07-01 17:12:01 +02:00
Balázs Orbán	9c0851c0f9	chore(ci): shorten names in `release.yml` workflow	2021-06-30 21:36:28 +02:00
Andriy Komm	f5b3c29ab1	fix(ts): improve `authorize` typing on Credentials provider (#2227 ) Co-authored-by: Balázs Orbán <info@balazsorban.com>	2021-06-30 15:49:38 +02:00
Nico Domino	b4f2a0106a	chore(ci): add environment approval (#2214 ) Co-authored-by: Balázs Orbán <info@balazsorban.com>	2021-06-30 15:28:12 +02:00
Balázs Orbán	9c095b0532	chore(dev): fix dev app when running locally (#2280 ) * fix: fix console warning in dev app * chore: add `npm i` to `dev:setup` script * chore(deps): update dev dependencies (react+next) * chore: update package-lock.json * chore: use node 16 in actions	2021-06-29 22:11:55 +02:00
Nico Domino	0475964a0f	chore(pages): typo in error messages (#2265 )	2021-06-28 02:57:35 +02:00
Justin Forlenza	ad6c13cdc9	fix(ts): extend `server` type in Email provider from `nodemailer` (#2259 ) * Added optional secure & TLS settings for SMTP * Replaced custom interface with nodemailers * Fix lockfile version * Apply suggestions from code review * Apply suggestions from code review * Apply suggestions from code review Co-authored-by: Balázs Orbán <info@balazsorban.com>	2021-06-27 18:51:34 +02:00
Nico Domino	591aa7cc7e	docs(adapter): rm `@canary` from adapters' install instructions (#2260 )	2021-06-27 18:28:58 +02:00
ndom91	9abb392b4e	chore: fix gh action typo	2021-06-27 03:39:38 +02:00
ndom91	b89ae87fb1	docs: respect color mode	2021-06-27 03:38:04 +02:00
ndom91	3687d17724	Merge branch 'main' of ssh://github.com/nextauthjs/next-auth	2021-06-27 03:11:07 +02:00
Balázs Orbán	b04ff82fb9	chore: clarify where to run envinfo in bug report template	2021-06-24 01:46:02 +02:00
Balázs Orbán	c11915ba9c	chore: update bug report template	2021-06-24 01:44:33 +02:00
Balázs Orbán	24ee459f97	chore(ci): run tests and typechecks only	2021-06-24 00:38:17 +02:00
Balázs Orbán	ac4851d238	chore(ci): run `test:ci` (linting+test+typecheck)	2021-06-24 00:33:32 +02:00
can-mihci	84094b0ee7	docs(client): fix code block typo (#2217 )	2021-06-22 20:11:18 +02:00
Vikrant Bhat	f09ab4a04f	docs(providers): fix typo (#2220 )	2021-06-22 20:08:43 +02:00
Vikrant Bhat	067364381b	docs(providers): fix english sentence in Email provider section (#2222 )	2021-06-22 09:28:47 +02:00
ndom91	6ee36b6842	ci: test release environment approval	2021-06-18 20:03:07 +02:00
Sangwon Park	5a89ab69d3	feat(provider): add Naver provider (#2172 ) * add Naver provider * fix typo * Update src/providers/naver.js Co-authored-by: Balázs Orbán <info@balazsorban.com> Co-authored-by: Balázs Orbán <info@balazsorban.com>	2021-06-16 00:46:41 +02:00
Balázs Orbán	665445818e	docs(config): link to next documentation instead of canary	2021-06-12 17:11:53 +02:00
ndom91	67cf2a11bb	docs: fix alt client provider example	2021-06-12 16:42:48 +02:00