URL Redirection Error on Authentication Failure (Middleware file)

[mdfaizanahmed786]

Describe the issue

Page URL: https://authjs.dev/getting-started/session-management/protecting#nextjs-middleware

import { auth } from "app/auth";

export default auth((req) => {
if (!req. auth) {
const url = req.url.replace(req.nextUrl.pathname, "/login")
return Response.redirect(url)
}
});

This redirects to the incorrect URL path if no session: http://login/localhost:3000/

Approach to Fix

Can use a similar standard approach

import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

// This function can be marked async if using await inside
export function middleware(request: NextRequest) {
return NextResponse.redirect(new URL('/home', request.url))
}

Expected behavior

It should redirect to http://localhost:3000/login

[sfsajid91]

This issue is found after upgrading Next.js to 14.2.

The current solution is to downgrade Next.js for now

[mdfaizanahmed786]

@sfsajid91 so, let this issue be opened?

[sfsajid91]

Let the issue be opened till the fix

[oyal]

I tried to do this, but got stuck in infinite redirection:

import { auth } from '@/auth'

export default auth((req) => {
  if (!req.auth) {
    const url = new URL('/auth/sign-in', req.nextUrl.origin)
    return Response.redirect(url)
  }
})

export const config = {
  matcher: ['/((?!api|_next/static|_next/image|favicon.ico).*)'],
}

"next": "14.2.3",
"next-auth": "^5.0.0-beta.18",

[ThangHuuVu]

@oyal to avoid infinite redirection, you'll need to exclude /login from the middleware

export const config = {
  matcher: ['/((?!/auth/sign-in|api|_next/static|_next/image|favicon.ico).*)'],
}

[ThangHuuVu]

@mdfaizanahmed786 seems like a documentation issue to me. The example code is wrong

    // input: 'http://localhost:3000/', output: 'http:/auth/signin/localhost:3000/' 
    const url = req.url.replace(req.nextUrl.pathname, "/auth/signin")

It should use the syntax new URL() like your "Approach to fix" section instead. And it isn't related to next version.

[ThangHuuVu]

Closing as duplicated, as it was fixed in #10815