Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Secret Option in Middleware #4846

Merged
merged 5 commits into from Jul 7, 2022
Merged

Secret Option in Middleware #4846

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
720b3b3
✨ provide secret via config
sean-nicholas Jul 5, 2022
0c33b59
🐛 make secret optional
sean-nicholas Jul 5, 2022
bc90283
📝 docs for middleware and env var
sean-nicholas Jul 5, 2022
aff4bdc
📝 recommendation at the end of paragraph
sean-nicholas Jul 5, 2022
6a3e3ed
Merge branch 'main' into feature/middleware-secret
balazsorban44 Jul 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
21 changes: 19 additions & 2 deletions docs/docs/configuration/nextjs.md
View file
Open in desktop
Expand Up @@ -80,10 +80,11 @@ You can get the `withAuth` middleware function from `next-auth/middleware` eithe

### Prerequisites

You must set the [`NEXTAUTH_SECRET`](/configuration/options#nextauth_secret) environment variable when using this middleware. If you are using the [`secret` option](/configuration/options#secret) this value must match.
You must set the same secret in the middleware that you use in NextAuth. The easiest way is to set the [`NEXTAUTH_SECRET`](/configuration/options#nextauth_secret) environment variable. It will be picked up by both the [NextAuth config](/configuration/options#options), as well as the middleware config.

**We strongly recommend** replacing the `secret` value completely with this `NEXTAUTH_SECRET` environment variable. This environment variable will be picked up by both the [NextAuth config](/configuration/options#options), as well as the middleware config.
Alternatively, you can provide the secret using the [`secret`](#secret) option in the middleware config.

**We strongly recommend** replacing the `secret` value completely with this `NEXTAUTH_SECRET` environment variable.

### Basic usage

Expand Down Expand Up @@ -149,6 +150,22 @@ See the documentation for the [pages option](/configuration/pages) for more info

---

### `secret`

- **Required**: _No_

#### Description

The same `secret` used in the [NextAuth config](/configuration/options#options).

#### Example (default value)

```js
secret: process.env.NEXTAUTH_SECRET
```

---

### Advanced usage

NextAuth.js Middleware is very flexible, there are multiple ways to use it.
Expand Down
3 changes: 1 addition & 2 deletions docs/docs/configuration/options.md
View file
Open in desktop
Expand Up @@ -27,9 +27,8 @@ Using [System Environment Variables](https://vercel.com/docs/concepts/projects/e

### NEXTAUTH_SECRET

Used to encrypt the NextAuth.js JWT, and to hash [email verification tokens](/adapters/models#verification-token). This is the default value for the [`secret`](/configuration/options#secret) option. The `secret` option might be removed in the future in favor of this.
Used to encrypt the NextAuth.js JWT, and to hash [email verification tokens](/adapters/models#verification-token). This is the default value for the `secret` option in [NextAuth](/configuration/options#secret) and [Middleware](/configuration/nextjs#secret).

If you are using [Middleware](/configuration/nextjs#prerequisites) this environment variable must be set.

### NEXTAUTH_URL_INTERNAL

Expand Down
10 changes: 9 additions & 1 deletion packages/next-auth/src/next/middleware.ts
View file
Open in desktop
Expand Up @@ -84,6 +84,12 @@ export interface NextAuthMiddlewareOptions {
*/
authorized?: AuthorizedCallback
}

/**
* The same `secret` used in the `NextAuth` configuration.
* Defaults to the `NEXTAUTH_SECRET` environment variable.
*/
secret?: string
}

async function handleMiddleware(
Expand All @@ -102,7 +108,8 @@ async function handleMiddleware(
return
}

if (!process.env.NEXTAUTH_SECRET) {
const secret = options?.secret ?? process.env.NEXTAUTH_SECRET
if (!secret) {
console.error(
`[next-auth][error][NO_SECRET]`,
`\nhttps://next-auth.js.org/errors#no_secret`
Expand All @@ -118,6 +125,7 @@ async function handleMiddleware(
req,
decode: options?.jwt?.decode,
cookieName: options?.cookies?.sessionToken?.name,
secret,
})

const isAuthorized =
Expand Down