Next-auth signin 重定向到 /signin?csrf=true

Question

i have implemented next-auth as in documentation,when i go to http://localhost:3001/api/auth/signin, i see this

after this when i click signin with google or github, i page refrshes and just gets redirected to http://localhost:3001/api/auth/signin?csrf=true nothing happens after that. its the same page.

my [...nextauth.js] file

    import NextAuth from "next-auth";
import Providers from "next-auth/providers";

export default NextAuth({
    providers: [
        Providers.Google({
            clientId: process.env.GOOGLE_CLIENT,
            clientSecret: process.env.GOOGLE_KEY,
        }),
        Providers.GitHub({
            clientId: process.env.GITHUB_CLIENT,
            clientSecret: process.env.GITHUB_SECRET,
        }),
    ],
});

any idea, why is it not working

i thing it has something to do with my node-express server the code for that is

const express = require("express");
const app = express();
const server = require("http").createServer(app);
const next = require("next");
const nextApp = next({ dev: true });
const nextHandler = nextApp.getRequestHandler();


/*******************ROUTES****************/
const userRoutes = require("./server/routes/user");

nextApp.prepare().then(() => {
    app.use("/node/user", userRoutes);
    app.all("*", (req, res) => nextHandler(req, res));
    server.listen(3001, err => {
        if (err) throw err;
        console.log("> ---------Server is ready on port 3001------------");
    });
});

Answer 1

I had something similar, also using a custom express server. Looking in next-auth/dist/server/index.js you end up hitting that redirect whenever csrfTokenVerified is false. In my case, the csrf token was being sent with the signin/[provider] request. I think that the client was sending the request body urlencoded, and this was not parsed by the express server so never made it is as far as the next auth server endpoints. I fixed it using node package bodyparser and adding this line to my express server setup app.use(urlencoded({ extended: true })); . I didn't have this problem with next v9, but did with newer releases.