-
-
Notifications
You must be signed in to change notification settings - Fork 3.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Credentials provider: request headers undefined in authorize callback on new Nodes #2612
Comments
I wouldn't say it's a bug, more of an inconvenience maybe. Feel free to open a PR that strips the internal options and cookies from the request. We want to gate people from messing with those. You have access to the original request though, just do: export default function auth(req, res) {
NextAuth(req, res, {
...
authorize(credentials) {
req
}
...
})
} |
Or add additional parameter: rawrequest |
this will actually change, once #2857 is merged! we won't pass the whole req anymore, as we won't have it. my comment from #2612 (comment) will be still valid, and we will continue to pass body, query, headers and method, usually the only ones that would be needed |
Hi there! It looks like this issue hasn't had any activity for a while. It will be closed if no further activity occurs. If you think your issue is still relevant, feel free to comment on it to keep it open. (Read more at #912) Thanks! |
Hi there! It looks like this issue hasn't had any activity for a while. To keep things tidy, I am going to close this issue for now. If you think your issue is still relevant, just leave a comment and I will reopen it. (Read more at #912) Thanks! |
Description 🐜
When using Credentials provider, the authorize callback should receive the incoming message object as the second parameter. However, on certain Node versions the incoming message has
undefined
asheaders
.This happens on Node versions 14.15.2, >=15.1 and >=16.0 and is related to this change: nodejs/node#35281 There is an issue on Node but it is closed (nodejs/node#36550)
A developer seems to be advising against using the spread operator on
headers
(nodejs/node#36550 (comment)) which is exactly what NextAuth is doing before callingauthorize
callback (next-auth/src/server/routes/callback.js
Line 339 in 0fae0c7
Is this a bug in your own project?
No
How to reproduce ☕️
Screenshots / Logs 📽
No response
Environment 🖥
Contributing 🙌🏽
No, I am afraid I cannot help regarding this
The text was updated successfully, but these errors were encountered: