Provide NEXTAUTH_SECRET via options to withAuth

[sean-nicholas]

Description 📓

NextAuth has the possibility to get the secret passed by its options. It would be great to have that for withAuth, too. Currently withAuth only accepts the secret via env vars. We don't store our secrets in env vars and now we have to patch process.env to get withAuth to run.

I'm happy to create a PR. Just wanted to know upfront if there is any reason why secret can not be passed to withAuth.

How to reproduce ☕️

Possible in NextAuth:

export default NextAuth({
  secret: '🤐',
})

Would be great to have this, too:

export default withAuth(middleware, {
  secret: '🤐',
})

Contributing 🙌🏽

Yes, I am willing to help implement this feature in a PR

[balazsorban44]

Just curious, how do you provide environment variables to your code then?

[sean-nicholas]

They are encrypted in the repo and are getting decrypted at runtime (decryption secret is provided via env var). We save them as .env file. But because vercel middleware does not support .env files (because fs is not supported) we save them as .ts file for the middleware.

Reasons:

• We have a mono repo with many apps and don't want to set env vars for every project on different providers (we use vercel, serverless, and a bunch more).
• In the past we have forgotten to set env vars and pushed code that did not work. That won't happen anymore ;)

[balazsorban44]

Sounds good then, thanks for explaining! I think we can consider this. 👍

Changes needed are here:

next-auth/packages/next-auth/src/next/middleware.ts

Line 105 in 4d4c276

if (!process.env.NEXTAUTH_SECRET) {

next-auth/packages/next-auth/src/next/middleware.ts

Line 86 in 4d4c276

}

And the wording in the docs:

https://next-auth.js.org/configuration/nextjs#prerequisites

https://next-auth.js.org/configuration/options#nextauth_secret

Especially the last one, as we should probably not consider removing this option after all.

Want to open a PR? 🙂

[sean-nicholas]

Yes. Will open a PR in the next few days :)

[sean-nicholas]

PR created ☺️ #4846

[sean-nicholas]

@balazsorban44 Thank you very much. This was a great developer experience. Really quick answers and merge 🤩. Keep up the great work :)

[adenugbamichael]

Pls am a beginner my withAuth file is not passing the any secret, the page is just blank

[adenugbamichael]

My withAuth Component////////////////////////////////////////////////////////////
////////////////////////////////////------------------------------------------

export default function (Component) {
return class withAuth extends React.Component {
renderProtectedPage() {
const { isAuthenticated } = this.props.auth

  if (isAuthenticated) {
    return <Component {...this.props} />
  } else {
    return (
      <BaseLayout {...this.props.auth}>
        <BasePage>
          <h1>
            You are not authenticated. Please Login to access this page.
          </h1>
        </BasePage>
      </BaseLayout>
    )
  }
}

render() {
  return
  this.renderProtectedPage()
}

}
}

[adenugbamichael]

class Secret extends React.Component {
render() {
debugger

return (
  <BaseLayout {...this.props.auth}>
    <BasePage>
      <h1>I am Secret Page</h1>
      <p>Secret Content Here</p>
    </BasePage>
  </BaseLayout>
)

}
}

export default withAuth(Secret)