VERCEL env causes signinUrl and others to be prefixed with https in local development #7202

dferber90 · 2023-04-09T09:44:54Z

Environment

System:
OS: macOS 13.3
CPU: (10) arm64 Apple M1 Pro
Memory: 5.52 GB / 32.00 GB
Shell: 5.9 - /bin/zsh
Binaries:
Node: 17.4.0 - ~/Library/Caches/fnm_multishells/16656_1681032588306/bin/node
Yarn: 1.22.15 - ~/Library/Caches/fnm_multishells/16656_1681032588306/bin/yarn
npm: 8.3.1 - ~/Library/Caches/fnm_multishells/16656_1681032588306/bin/npm
Browsers:
Chrome: 112.0.5615.49
Firefox: 111.0.1
Safari: 16.4

Reproduction URL

can be reproduced with next-auth-example by adding VERCEL="1" env var

Describe the issue

next-auth fails if an VERCEL="1" env var is present - even if it's set to VERCEL="0".

I use vc env pull .env.local to pull the Vercel defined env vars to my machine.

This creates a VERCEL="1" env var. But as soon as this is present the sign in no longer works as
I get redirected to https://localhost:3000/api/auth/signin?csrf=true (notice the https) when trying to sign in.

I debugged this and noticed the following: If you open http://localhost:3000/api/auth/providers you will see this

{
  "github": {
    "id": "github",
    "name": "GitHub",
    "type": "oauth",
    "signinUrl": "https://localhost:3000/api/auth/signin/github",
    "callbackUrl": "https://localhost:3000/api/auth/callback/github"
  }
}

Note that signinUrl and callbackUrl are prefixed with https. This prefix goes away as soon as you remove the VERCEL="1" env var.

How to reproduce

Create a VERCEL="1" env var and try to sign in.

Next.js version 13.3.0
next-auth version 4.21.1

Expected behavior

Sign in should work. It should not redirect to https locally.

This slightly relates to #4363

The text was updated successfully, but these errors were encountered:

Crazypersonalph · 2023-04-10T03:05:24Z

I have had this issue before.
This is because the cookies you are creating for authentication/session stuff are HTTPS only, so they are not allowed to be used with HTTP only, therefore causing the redirect.

Crazypersonalph · 2023-04-10T03:08:25Z

I know in SvelteKitAuth, which is just this project being wrapped for sveltekit, there is an option called useSecureCookies, which by default it is on in production, to protect the cookie information. You can manually disable it.

Crazypersonalph · 2023-04-10T03:13:19Z

It may also be that Vercel is changing around the links by itself without your knowledge, keep an eye out for that.

dferber90 · 2023-04-10T10:17:12Z

Thanks for your hints! However I don't think it's related to useSecureCookies as it can be reproduced in an incognito window. This is specifically about the VERCEL env var being present.

As soon as this is set, the /api/auth/providers endpoint returns https for the signinUrl instead of http.

It doesn't even matter which value VERCEL holds, it can even be Vercel="0" and it will still start using https.

Crazypersonalph · 2023-04-10T11:11:18Z

Looks like this may hold an answer:
vercel/vercel#1745

dferber90 · 2023-04-10T11:25:56Z

It's not related. This is really about the use of process.env.VERCEL within the next-auth code base itself. It is even reproducible locally, so it's not an issue of being hosted on Vercel :blob_smile:

Sorry if it wasn't clear earlier: I work at Vercel and I'll get this sorted internally too :)

Crazypersonalph · 2023-04-10T11:30:36Z

It's not related. This is really about the use of process.env.VERCEL within the next-auth code base itself. It is even reproducible locally, so it's not an issue of being hosted on Vercel

Sorry if it wasn't clear earlier: I work at Vercel and I'll get this sorted internally too :)

I know this isn't related, but that is really cool! I am a student just playing around in the web dev space, and normally I use C++. Thank you for your contribution!

fsa317 · 2023-04-10T18:56:52Z

I am having the same issue @dferber90 . Is there a workaround?

fsa317 · 2023-04-11T01:47:36Z

From what I can see it looks like this code uses that env variable to determine if to use secure cookies:

next-auth/packages/next-auth/src/jwt/index.ts

Line 73 in 62f672a

secureCookie = process.env.NEXTAUTH_URL?.startsWith("https://") ??

Crazypersonalph · 2023-04-11T02:22:19Z

From what I can see it looks like this code uses that env variable to determine if to use secure cookies:

next-auth/packages/next-auth/src/jwt/index.ts

Line 73 in 62f672a

secureCookie = process.env.NEXTAUTH_URL?.startsWith("https://") ??

That is what I was thinking about before when I looked through the code, but @dferber90 said that it wasn't related to secureCookies, so the issue is probably not a result of that code.

dferber90 · 2023-04-11T03:54:18Z

I am having the same issue @dferber90 . Is there a workaround?

The workaround I used was to comment out the VERCEL env var in my .env.local file manually. It's not a great workaround but at least it unblocked me.

@Crazypersonalph I was trying to say that it's not related to any cookies I already have, but the error is definitely somewhere in the logic of how next-auth detects whether to use https or not.

Crazypersonalph · 2023-04-11T06:25:28Z

I am having the same issue @dferber90 . Is there a workaround?

The workaround I used was to comment out the VERCEL env var in my .env.local file manually. It's not a great workaround but at least it unblocked me.

@Crazypersonalph I was trying to say that it's not related to any cookies I already have, but the error is definitely somewhere in the logic of how next-auth detects whether to use https or not.

I have an idea.
What if that because of the VERCEL env var being there in the command line, it overrides the env var in your file? This would mean that in that line of code the NEXTAUTH_URL would be the Vercel appointed URL, and so Vercel is upgrading the connection to HTTPS to fit the requirement of the secureCookie to be HTTPS.

balazsorban44 · 2023-04-11T10:09:28Z

I found the issue and created an experimental release with a fix, if anyone wants to test #7214 (comment)

TLDR; we need to respect the x-forwarded-proto header if present when trusting the host. (In this case when VERCEL environment variable is set).

VERCEL=0 did not help BTW because env variables are always read as strings, and we do not parse the variable to int, so only removing/commenting out would have worked.

Crazypersonalph · 2023-04-16T11:09:41Z

It is safe to say that this issue can now be closed.

balazsorban44 · 2023-04-18T19:10:48Z

This should be released in 4.22.1!

MarcinCebula · 2023-06-11T03:57:03Z

Hey @balazsorban44

There is a case where respecting x-forwarded-proto it not true. When using Zones the url returned would be wrong and would cause multiple issue.

you would get the wrong domian
you would get the wrong basePath

For example
https://github.com/nextauthjs/next-auth/blob/c7dec376a1272a0877c7e6fb2fc4173f08369f9f/packages/next-auth/src/utils/detect-origin.ts#LL5C1-L6C1

The desired url might be https://mydomain/app2/auth/....
btw when doing SignIn from App2 using Zones on Vercel you would get https://app2.mydomain/auth/...

Please notice the subdomain and basePath

NOTES:

Things to note. For zones to work correctly most people extract x-forwarded-proto in middleware and set it to some other header like x-app-root-url
A hackey solution to quickly solve this issue is to set VERCEL="" in ENV

Would love to discuss a solution for this issue and maybe create a example project to showcase the issue

montnyc · 2023-08-12T02:33:17Z

I am having the same issue @dferber90 . Is there a workaround?

The workaround I used was to comment out the VERCEL env var in my .env.local file manually. It's not a great workaround but at least it unblocked me.

@Crazypersonalph I was trying to say that it's not related to any cookies I already have, but the error is definitely somewhere in the logic of how next-auth detects whether to use https or not.

This is the only thing that worked for me... Was banging my head against the wall. Thanks! Would love an actual fix tho

leogilmour · 2023-09-07T09:56:14Z

We are still having this issue. Finally figured it out and commented VERCEL="1" out

"next": "^13.4.19",
"next-auth": "^4.23.1",

toniopelo · 2023-10-01T15:55:35Z

@dferber90 @balazsorban44 @leogilmour There is a more convenient workaround I just tested, to be able to still use vercel env pull without having to comment out VERCEL="1" every time. Just add an env var for development only on vercel platform, name this env var VERCEL and leave the value blank. This is pretty dumb but it works without breaking vercel env updating flow.

A fix on nextauth side is still needed IMO because this shouldn't be needed.

fsa317 · 2023-10-28T13:20:55Z

I seem to still be having this issue on the latest NEXT_AUTH

dipsor · 2023-11-10T19:07:49Z

I am having same issue

piersolenski · 2023-11-29T13:52:10Z

I too, am a haver of this issue

gloriliale · 2023-11-30T21:17:28Z

Same here!

pktaki · 2024-03-23T09:22:52Z

I'm also having the same issue, even after removing VERCEL="1" from .env, on version 4.23.1.

Does anyone know a fix for this issue?

reginpv · 2024-07-13T04:46:57Z

I am having the same issue @dferber90 . Is there a workaround?

The workaround I used was to comment out the VERCEL env var in my .env.local file manually. It's not a great workaround but at least it unblocked me.

@Crazypersonalph I was trying to say that it's not related to any cookies I already have, but the error is definitely somewhere in the logic of how next-auth detects whether to use https or not.

This is what I do currently, but is there a permanent fix? If I vercel env pull it will change again to 1

reginpv · 2024-07-13T04:56:56Z

@dferber90 @balazsorban44 @leogilmour There is a more convenient workaround I just tested, to be able to still use vercel env pull without having to comment out VERCEL="1" every time. Just add an env var for development only on vercel platform, name this env var VERCEL and leave the value blank. This is pretty dumb but it works without breaking vercel env updating flow.

A fix on nextauth side is still needed IMO because this shouldn't be needed.

This is the one that works for me! Thank you!

dferber90 added the triage Unseen or unconfirmed by a maintainer yet. Provide extra information in the meantime. label Apr 9, 2023

balazsorban44 added bug Something isn't working and removed triage Unseen or unconfirmed by a maintainer yet. Provide extra information in the meantime. labels Apr 11, 2023

balazsorban44 mentioned this issue Apr 11, 2023

fix: respect protocol too, when host is trusted #7214

Merged

dferber90 closed this as completed Apr 16, 2023

balazsorban44 mentioned this issue Jul 7, 2023

Vercel environment variable breaks sign in flow in dev mode #7962

Open

This was referenced Oct 1, 2023

Having the VERCEL env variable set breaks dev server (rewrites to HTTPS & trigger ERR_SSL_PROTOCOL_ERROR) #8385

Closed

NextAuth uses https://localhost:3000, when the production URL is different #6371

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

VERCEL env causes signinUrl and others to be prefixed with https in local development #7202

VERCEL env causes signinUrl and others to be prefixed with https in local development #7202

dferber90 commented Apr 9, 2023 •

edited

Loading

Crazypersonalph commented Apr 10, 2023

Crazypersonalph commented Apr 10, 2023 •

edited

Loading

Crazypersonalph commented Apr 10, 2023

dferber90 commented Apr 10, 2023 •

edited

Loading

Crazypersonalph commented Apr 10, 2023

dferber90 commented Apr 10, 2023 •

edited

Loading

Crazypersonalph commented Apr 10, 2023

fsa317 commented Apr 10, 2023

fsa317 commented Apr 11, 2023

Crazypersonalph commented Apr 11, 2023 •

edited

Loading

dferber90 commented Apr 11, 2023

Crazypersonalph commented Apr 11, 2023

balazsorban44 commented Apr 11, 2023 •

edited

Loading

Crazypersonalph commented Apr 16, 2023

balazsorban44 commented Apr 18, 2023

MarcinCebula commented Jun 11, 2023 •

edited

Loading

montnyc commented Aug 12, 2023

leogilmour commented Sep 7, 2023 •

edited

Loading

toniopelo commented Oct 1, 2023

fsa317 commented Oct 28, 2023

dipsor commented Nov 10, 2023

piersolenski commented Nov 29, 2023

gloriliale commented Nov 30, 2023

pktaki commented Mar 23, 2024

reginpv commented Jul 13, 2024

reginpv commented Jul 13, 2024

VERCEL env causes signinUrl and others to be prefixed with https in local development #7202

VERCEL env causes signinUrl and others to be prefixed with https in local development #7202

Comments

dferber90 commented Apr 9, 2023 • edited Loading

Environment

Reproduction URL

Describe the issue

How to reproduce

Expected behavior

Crazypersonalph commented Apr 10, 2023

Crazypersonalph commented Apr 10, 2023 • edited Loading

Crazypersonalph commented Apr 10, 2023

dferber90 commented Apr 10, 2023 • edited Loading

Crazypersonalph commented Apr 10, 2023

dferber90 commented Apr 10, 2023 • edited Loading

Crazypersonalph commented Apr 10, 2023

fsa317 commented Apr 10, 2023

fsa317 commented Apr 11, 2023

Crazypersonalph commented Apr 11, 2023 • edited Loading

dferber90 commented Apr 11, 2023

Crazypersonalph commented Apr 11, 2023

balazsorban44 commented Apr 11, 2023 • edited Loading

Crazypersonalph commented Apr 16, 2023

balazsorban44 commented Apr 18, 2023

MarcinCebula commented Jun 11, 2023 • edited Loading

montnyc commented Aug 12, 2023

leogilmour commented Sep 7, 2023 • edited Loading

toniopelo commented Oct 1, 2023

fsa317 commented Oct 28, 2023

dipsor commented Nov 10, 2023

piersolenski commented Nov 29, 2023

gloriliale commented Nov 30, 2023

pktaki commented Mar 23, 2024

reginpv commented Jul 13, 2024

reginpv commented Jul 13, 2024

dferber90 commented Apr 9, 2023 •

edited

Loading

Crazypersonalph commented Apr 10, 2023 •

edited

Loading

dferber90 commented Apr 10, 2023 •

edited

Loading

dferber90 commented Apr 10, 2023 •

edited

Loading

Crazypersonalph commented Apr 11, 2023 •

edited

Loading

balazsorban44 commented Apr 11, 2023 •

edited

Loading

MarcinCebula commented Jun 11, 2023 •

edited

Loading

leogilmour commented Sep 7, 2023 •

edited

Loading