Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhance Robustness of auth-js Middleware #818

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Conversation

catnaut
Copy link

@catnaut catnaut commented Nov 9, 2024

index.ts:

docs:

This is my first attempt at backend development, and I would really appreciate a thorough review and any suggestions. I’m still learning and want to make sure everything is implemented correctly. Thank you for your help!

Copy link

changeset-bot bot commented Nov 9, 2024

🦋 Changeset detected

Latest commit: a149c1e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@hono/auth-js Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@yusukebe
Copy link
Member

Hi @catnaut

Is this ready for review?

…n handling

- Refactored getSession based on https://github.com/nextauthjs/next-auth/blob/main/packages/frameworks-express/src/index.ts for improved alignment.
- Replaced redundant Env handling with @auth/core's setEnvDefaults for cleaner configuration.
- Removed redundant configuration checks already handled in @auth/core.
In the default example, use `basePath` as it aligns with v5 behavior where the host is inferred from request headers. Setting `AUTH_URL` is only necessary if a custom base path is needed.
(e.g., `AUTH_URL=http://localhost:3000/web/auth`)
@catnaut catnaut marked this pull request as ready for review November 13, 2024 13:01
@catnaut
Copy link
Author

catnaut commented Nov 13, 2024

@yusukebe

Yup, it's all set and ready for your review! 😊

@yusukebe
Copy link
Member

@catnaut Thanks!

Hi @divyam234, Sorry to bother you. Can you review this?

@divyam234
Copy link
Contributor

divyam234 commented Nov 14, 2024

@catnaut Usually handling of x-forwarded headers is handled at webserver like nginx or caddy so that it's not tampered with in first place for nextjs its already handled by vercel so current solution is valid for next-auth . Also setting AUTH_URL completley bypasses it. It should not be removed instead we can mention in doc how to mitigate it if people are not using webserver but I doubt that if anyone is deploying any application without webserver in production.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants