fix: default to VERCEL_URL for callbackUrl

package-lock.json

@@ -11,6 +11,10 @@
         {
           "type": "github",
           "url": "https://github.com/sponsors/balazsorban44"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/nextauth"
         }
       ],
       "license": "ISC",

src/core/index.ts

@@ -74,7 +74,7 @@ export async function NextAuthHandler<
     action,
     providerId,
     host: req.host,
-    callbackUrl: req.body?.callbackUrl ?? req.query?.callbackUrl,
+    callbackUrl: req.body?.callbackUrl ?? req.query?.callbackUrl ?? req.host,
     csrfToken: req.body?.csrfToken,
     cookies: req.cookies,
     isPost: method === "POST",

src/core/init.ts

@@ -100,7 +100,7 @@ export async function init({
     // Callback functions
     callbacks: { ...defaultCallbacks, ...userOptions.callbacks },
     logger,
-    callbackUrl: process.env.NEXTAUTH_URL ?? "http://localhost:3000",
+    callbackUrl: "http://localhost:3000",
   }
 
   // Init cookies

src/next/index.ts

@@ -21,7 +21,10 @@ async function NextAuthNextHandler(
   const { nextauth, ...query } = req.query
   const handler = await NextAuthHandler({
     req: {
-      host: (process.env.NEXTAUTH_URL ?? process.env.VERCEL_URL) as string,
+      host:
+        process.env.NEXTAUTH_URL ??
+        process.env.VERCEL_URL ??
+        "http://localhost:3000",
       body: req.body,
       query,
       cookies: req.cookies,