feat: make missing secret an error #3143
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## beta #3143 +/- ##
==========================================
- Coverage 13.86% 13.60% -0.26%
==========================================
Files 87 88 +1
Lines 1363 1389 +26
Branches 354 362 +8
==========================================
Hits 189 189
- Misses 1163 1189 +26
Partials 11 11
Continue to review full report at Codecov.
|
|
I moved the user config assertion to the core, and refactored the code so that in case of a configuration error, we either render the default error page or redirect to the user's custom one. The error is still logged through
|
|
🎉 Experimental release published on npm! npm i [email protected]yarn add [email protected] |
balazsorban44
commented
Nov 15, 2021
ubbe-xyz
approved these changes
Nov 15, 2021
mnphpexpert
added a commit
to mnphpexpert/next-auth
that referenced
this pull request
Sep 2, 2024
BREAKING CHANGE: It is now required to set a `secret` in production.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If no
secretspecified inNextAuthOptions,next-authgenerates one based on the user configuration. If the user does not use an OAuth provider, the generated secret will not contain enough entropy. Someone could guess the user's config, thus gaining access to the JWT encryption method. We already make this clear in the docs by saying:This PR makes this an error in production.
The corresponding documentation is also made more clear, see nextauthjs/docs#103