Partial use of NextAuth for sessions and security features

[sheptang]

I'm willing to combine my sign-in and sign-up logic, simply due to the fact that I have a single form to handle both. I've already implemented the sign-up logic in a file named sign.js. Obviously, this is not the [...nextauth.js] file, therefore, I don't know where and how to write the sign-in logic.

Basically, credentials matching part is already ready for the sign-in logic, but it's in the sign.js file, too. So I'm trying to figure out how I can trigger session creation and automatic CSRF handling through that custom function for signing in.

So, currently, my pages/api/auth has two files: [...nextauth.js] and sign.js. Should I just trigger signIn() function of NextAuth from that custom logic without any parameters, so it'll just do what I want and skip everything that has been already handled by my custom functions? If not, how can I implement this in a feasible way?

I like NextAuth, simply because it handles all that stuff that I'm too lazy to get my hands dirty with, and it is somehow related to NextJS ecosystem. But I seriously need this customized approach, so that is why either I find a way out of this, or I have to dump NextAuth and possibly write all that myself or just switch to iron-session (which, I do not want to).

P.S: Obviously, I'm using Credentials provider.
Any ideas or contribution is appreciated. If you need the code of the sign.js, please let me know and I'll include. Thanks!

[sheptang]

Any ideas, please, anyone?

[Fronix]

@sheptang no need, if it's long to describe that's fine :) Was just curious

[sheptang]

I'll just sum it up;
My sign-up logic doesn't even use [...nextauth].js. But the sign-in part, I had to use the following code in the [...nextauth].js:

export default NextAuth({
	providers: [
		Providers.Credentials({
			async authorize(credentials){
				const user = credentials.user;
				return user;
			}
		})
	],
	callbacks: {
		async signIn(user){
			if(user){
				return userId;
			}
		},
		async session(session){
			return session;
		},
		async jwt(token){
			return token;
		}
	}
});

And when I call this (somewhere on client side):

// pseudo result after fetch
result = {
	message: {
		user: "user"
	}
}
const signStatus = async () => await signIn("credentials", {redirect: false, user: result.message.user});
signStatus().then(() => {
	return router.push("/");
}).catch(err => console.log(err));

It simply works as I want! 😉

[sheptang]

Side note, yes, you have to use .catch. If you don't, you'll have UnhandledPromiseRejectionWarning

[Fronix]

I see, that's a really nifty solution! Glad you shared, might come in handy some day :)

[sheptang]

I forgot to replace userId with user on the example, but yeah. Hope it'd be useful for someone.