Breaking change with local testing using V4 plugin

[bweber]

Checklist

• The issue can be reproduced in the nextjs-auth0 sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

We are currently using the npm package oidc-provider recommended here: https://github.com/auth0/nextjs-auth0/blob/main/TESTING.md

Given that, with the change to the new AUTH0_DOMAIN, it throws an error if you prepend http:// on the front of the domain saying it cannot contain a schema.

This creates a breaking change for us as we need to disable https for local testing.

The alternative is a way to disable SSL validation to support self-signed certificates for local development as it appears this is failing.

We do not want to do local development directly against Auth0 as we generate dummy user accounts for testing and don't want to share ClientID/Secrets amongst all of our developers.

Reproduction

1. Create an Next 15 application with Beta V4 plugin configured with the following:

AUTH0_SECRET=test
AUTH0_DOMAIN=host.docker.internal:3001
AUTH0_CLIENT_ID=test
AUTH0_CLIENT_SECRET=test
APP_BASE_URL=http://localhost:3000

2. Setup a NodeJS application with oidc-provider running on port 3001 using the following env variables:

PORT=3001
AUTH0_AUDIENCE=test_application
APP_BASE_URL=http://localhost:3000
AUTH0_DOMAIN=http://host.docker.internal:3001/
AUTH0_CLIENT_ID=test
AUTH0_CLIENT_SECRET=test

My oidc-provider configuration is as follows:

const baseUrl = process.env.APP_BASE_URL;
const audience = process.env.AUTH0_AUDIENCE;
const clientId = process.env.AUTH0_CLIENT_ID;
const clientSecret = process.env.AUTH0_CLIENT_SECRET;
const domain = process.env.AUTH0_DOMAIN;

const issueRefreshToken = async function (_ctx, client, code) {
  if (!client.grantTypeAllowed('refresh_token')) {
    return false;
  }
  return (
    code.scopes.has('offline_access') ||
    (client.applicationType === 'web' && client.clientAuthMethod === 'none')
  );
};

const config = {
  clients: [
    {
      client_id: clientId,
      client_secret: clientSecret,
      redirect_uris: [`${baseUrl}/auth/callback`],
      post_logout_redirect_uris: [baseUrl],
      token_endpoint_auth_method: 'client_secret_post',
      grant_types: ['authorization_code', 'refresh_token'],
    },
  ],
  routes: {
    authorization: '/authorize',
    token: '/oauth/token',
    end_session: '/v2/logout',
    jwks: '/.well-known/jwks.json'
  },
  claims: {
    profile: ['name', 'picture', 'family_name', 'given_name'],
    email: ['email', 'email_verified'],
  },
  findAccount: LocalAccount.findAccount,
  issueRefreshToken: issueRefreshToken,
  features: {
    resourceIndicators: {
      enabled: true,
      defaultResource() {
        return baseUrl;
      },
      useGrantedResource() {
        return true;
      },
      getResourceServerInfo(_ctx, resourceIndicator) {
        if (resourceIndicator === baseUrl) {
          return {
            scope: 'api:access',
            audience,
            accessTokenTTL: 1 * 60 * 60,
            accessTokenFormat: 'jwt',
          };
        }

        throw new Error(`Unable to find resource for resource URL ${resourceIndicator}`);
      },
    },
  },
};

const createProvider = () => {
  const provider = new Provider(domain, config);

  provider.use(async (ctx, next) => {
    await next();

    if (ctx.oidc?.route === 'end_session_success') {
      ctx.redirect(baseUrl);
    }
  });

  return provider;
};

export default createProvider;

The rest of the NextJS and Auth0 setup matches what is in the documentation in the Readme for V4.

Additional context

No response

nextjs-auth0 version

v4-beta10

Next.js version

15

Node.js version

22

[bweber]

Some additional information. When I setup a self-signed SSL certificate for local testing, it fails the discovery check in this method in the dependent library: https://github.com/panva/oauth4webapi/blob/d2085804c79783ec52feb391953f06d2461675be/src/index.ts#L1180

I was able to verify the URL it is trying to call does load from the oidc-provider library at .well-known/openid-configuration however, I believe it is failing to validate the SSL certificate since it is self-signed.

[guabu]

Hey @bweber 👋 Thanks for the feedback here! The underlying library you mentioned no longer allows non-HTTPS requests as of v3 without passing a specific flag.

In the upcoming release (linked above), you should be able to pass an allowInsecureRequests flag (only when NODE_ENV is not production), like so:

import { Auth0Client } from "@auth0/nextjs-auth0/server"

export const auth0 = new Auth0Client({
  allowInsecureRequests: true,
})

and specify an issuer with a protocol (e.g.: http://my-local-mock-oidc-server).

Hopefully this should help with developing locally against the mock OIDC server.

[guabu]

The latest release (4.0.0-beta.11) should now contain the above changes. Would you mind upgrading when you have a moment and let us know if this resolves the issue for you?

[bweber]

The changes work when I am running using next dev, however, it does NOT work when I am running the application in a Docker container or with next start because NextJS forces production mode in that scenario. For local acceptance/integration testing, this breaks for us as we standup oidc-provider and our application in Docker containers and test using Playwright.

Is there a way we can remove these lines from the auth0-client:

nextjs-auth0/src/server/auth-client.ts

Lines 139 to 143 in 1e482a4

	if (this.allowInsecureRequests && process.env.NODE_ENV === "production") {
	throw new Error(
	"Insecure requests are not allowed in production environments."
	)
	}

I removed them from the copy in my node_modules to verify this works with next start and it worked as expected.

[guabu]

Is there a way we can remove these lines from the auth0-client

We'd like to make sure the setting is not unintentionally left enabled in production. We can change it to log a warning in the console instead of throwing an error to support the use case of running next start in e2e tests.

[bweber]

Yea, that would be good. If we can log a warning to ensure developers see it, that is how the underlying library you are using is also working by showing a warning about an insecure issuer.

As long as we aren't throwing an error here, this will fix my issue for local testing.

[guabu]

Sounds good, we'll get that fixed in the next release. Thanks for your feedback!

[bweber]

Awesome, do you know when that may be? Any way we can cut a new release with the change?

[guabu]

Hey @bweber 👋 The latest release (4.0.0-beta.12) should contain these changes

[bweber]

@guabu Just verified this worked. Thank you again!