Merge commit from fork

getSession() calls @auth/core, which returns a 500 with a JSON body of
{ message: "There was a problem with the server configuration..." } when
the provider configuration is invalid (e.g. a provider missing both
`issuer` and `authorization` endpoints). The next-auth wrappers read that
body with .json() without checking the response status, so the error object
was assigned to req.auth. Truthiness checks such as `!!auth` / `if (!req.auth)`
- the pattern shown in the docs - then evaluated as authenticated for every
request, failing open and exposing protected routes during a misconfiguration.

Parse the session response through a helper that returns null on any non-OK
response, so all auth() entry points (RSC, middleware inline/wrapper, API
routes) fail closed. Add a regression test reproducing the InvalidEndpoints
misconfiguration.

Fixes GHSA-8fpg-xm3f-6cx3

Author: Bekacru

packages/next-auth/src/lib/index.ts

@@ -96,6 +96,23 @@ async function getSession(headers: Headers, config: NextAuthConfig) {
   }) as Promise<Response>
 }
 
+/**
+ * Reads the session payload from a `getSession()` response.
+ *
+ * On any non-OK response (e.g. a `500` returned by `@auth/core` when the
+ * provider configuration is invalid), the body is an error object such as
+ * `{ message: "There was a problem with the server configuration..." }`.
+ * Returning that object as the session would make truthiness checks like
+ * `!!auth` pass for everyone, failing open. Treat any non-OK response as
+ * "no session" so auth checks fail closed.
+ */
+async function parseSessionResponse(
+  response: Response
+): Promise<Session | null> {
+  if (!response.ok) return null
+  return (await response.json()) satisfies Session | null
+}
+
 export interface NextAuthRequest extends NextRequest {
   auth: Session | null
 }
@@ -131,7 +148,7 @@ export function initAuth(
         const _config = await config(undefined) // Review: Should we pass headers() here instead?
         onLazyLoad?.(_config)
 
-        return getSession(_headers, _config).then((r) => r.json())
+        return getSession(_headers, _config).then(parseSessionResponse)
       }
 
       if (args[0] instanceof Request) {
@@ -168,14 +185,14 @@ export function initAuth(
       // @ts-expect-error -- request is NextRequest
       return getSession(new Headers(request.headers), _config).then(
         async (authResponse) => {
-          const auth = await authResponse.json()
+          const auth = await parseSessionResponse(authResponse)
 
           for (const cookie of authResponse.headers.getSetCookie())
             if ("headers" in response)
               response.headers.append("set-cookie", cookie)
             else response.appendHeader("set-cookie", cookie)
 
-          return auth satisfies Session | null
+          return auth
         }
       )
     }
@@ -184,7 +201,7 @@ export function initAuth(
     if (!args.length) {
       // React Server Components
       return Promise.resolve(headers()).then((h: Headers) =>
-        getSession(h, config).then((r) => r.json())
+        getSession(h, config).then(parseSessionResponse)
       )
     }
     if (args[0] instanceof Request) {
@@ -218,13 +235,13 @@ export function initAuth(
       new Headers(request.headers),
       config
     ).then(async (authResponse) => {
-      const auth = await authResponse.json()
+      const auth = await parseSessionResponse(authResponse)
 
       for (const cookie of authResponse.headers.getSetCookie())
         if ("headers" in response) response.headers.append("set-cookie", cookie)
         else response.appendHeader("set-cookie", cookie)
 
-      return auth satisfies Session | null
+      return auth
     })
   }
 }
@@ -236,7 +253,7 @@ async function handleAuth(
 ) {
   const request = reqWithEnvURL(args[0])
   const sessionResponse = await getSession(request.headers, config)
-  const auth = await sessionResponse.json()
+  const auth = await parseSessionResponse(sessionResponse)
 
   let authorized: boolean | NextResponse | Response | undefined = true
 

packages/next-auth/test/middleware-fail-closed.test.ts

@@ -0,0 +1,66 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest"
+import NextAuth, { type NextAuthConfig } from "../src"
+
+// A provider with neither `issuer` nor an `authorization` endpoint makes
+// `@auth/core` bail out of every request with a `500 { message }` response.
+// See GHSA-8fpg-xm3f-6cx3.
+const brokenConfig: NextAuthConfig = {
+  providers: [
+    {
+      id: "broken",
+      name: "Broken",
+      type: "oidc",
+      clientId: "client-id",
+      clientSecret: "client-secret",
+    },
+  ],
+}
+
+let mockedHeaders = vi.hoisted(() => new globalThis.Headers())
+
+vi.mock("next/headers", async (importOriginal) => {
+  const originalModule = await importOriginal<typeof import("next/headers")>()
+  return {
+    ...originalModule,
+    headers: () => mockedHeaders,
+  }
+})
+
+describe("auth checks fail closed on provider configuration errors", () => {
+  beforeEach(() => {
+    mockedHeaders = new globalThis.Headers()
+    process.env.AUTH_SECRET = "secret"
+    process.env.AUTH_URL = "https://app.example.com/api/auth"
+  })
+
+  afterEach(() => {
+    vi.clearAllMocks()
+    delete process.env.AUTH_SECRET
+    delete process.env.AUTH_URL
+  })
+
+  it("returns null instead of an error object from the RSC `auth()` call", async () => {
+    const { auth } = NextAuth(brokenConfig)
+
+    const session = await auth()
+
+    // Before the fix, the 500 error body `{ message: "..." }` was returned
+    // verbatim, making `!!auth` truthy for everyone (fail open).
+    expect(session).toBeNull()
+  })
+
+  it("sets `req.auth` to null in the middleware wrapper", async () => {
+    const { auth } = NextAuth(brokenConfig)
+
+    let observed: unknown = "unset"
+    const handler = auth((req) => {
+      observed = req.auth
+    })
+
+    const req: any = new Request("https://app.example.com/dashboard")
+    req.nextUrl = new URL("https://app.example.com/dashboard")
+    await handler(req, {} as any)
+
+    expect(observed).toBeNull()
+  })
+})