fix: properly handle callback URL fallback (#3402)

* fix: don't default to localhost on `host`

* fall back to `host` for `callbackUrl`

* use parsed host

* remove unnecessary type cast

app/package.json

@@ -21,7 +21,7 @@
     "@prisma/client": "^2.29.1",
     "fake-smtp-server": "^0.8.0",
     "faunadb": "^4.3.0",
-    "next": "^11.1.0",
+    "next": "^12.0.7",
     "nodemailer": "^6.6.3",
     "react": "^17.0.2",
     "react-dom": "^17.0.2"

package.json

@@ -123,7 +123,7 @@
     "jest": "^27.3.0",
     "jest-watch-typeahead": "^1.0.0",
     "msw": "^0.35.0",
-    "next": "v11.1.3-canary.0",
+    "next": "12.0.7",
     "postcss-cli": "^9.0.1",
     "postcss-nested": "^5.0.6",
     "prettier": "^2.4.1",

src/core/index.ts

@@ -12,7 +12,7 @@ import type { ErrorType } from "./pages/error"
 
 export interface IncomingRequest {
   /** @default "http://localhost:3000" */
-  host: string
+  host?: string
   method?: string
   cookies?: Record<string, string>
   headers?: Record<string, any>
@@ -74,7 +74,7 @@ export async function NextAuthHandler<
     action,
     providerId,
     host: req.host,
-    callbackUrl: req.body?.callbackUrl ?? req.query?.callbackUrl ?? req.host,
+    callbackUrl: req.body?.callbackUrl ?? req.query?.callbackUrl,
     csrfToken: req.body?.csrfToken,
     cookies: req.cookies,
     isPost: method === "POST",

src/core/init.ts

@@ -100,7 +100,7 @@ export async function init({
     // Callback functions
     callbacks: { ...defaultCallbacks, ...userOptions.callbacks },
     logger,
-    callbackUrl: "http://localhost:3000",
+    callbackUrl: url.origin,
   }
 
   // Init cookies

src/next/index.ts

@@ -21,10 +21,7 @@ async function NextAuthNextHandler(
   const { nextauth, ...query } = req.query
   const handler = await NextAuthHandler({
     req: {
-      host:
-        process.env.NEXTAUTH_URL ??
-        process.env.VERCEL_URL ??
-        "http://localhost:3000",
+      host: process.env.NEXTAUTH_URL ?? process.env.VERCEL_URL,
       body: req.body,
       query,
       cookies: req.cookies,
@@ -90,7 +87,7 @@ export async function getServerSession(
   const session = await NextAuthHandler<Session | {}>({
     options,
     req: {
-      host: (process.env.NEXTAUTH_URL ?? process.env.VERCEL_URL) as string,
+      host: process.env.NEXTAUTH_URL ?? process.env.VERCEL_URL,
       action: "session",
       method: "GET",
       cookies: context.req.cookies,