Using Postman or REST Client extension

[DNoel26]

I recently started learning NextAuth and I have three questions:

1. Why does the session token only show in the browser and not Postman (or REST Client) when I use the default signin and return a static user object?

2. How do I setup Postman to work so that it doesn't skip the authorize function and callbacks?

3. Why are my req and res objects undefined?

next-auth.session-token (only shows on browser)
next-auth.csrf-token (shows up on both browser and Postman)
next-auth.callback-url (shows up on both browser and Postman)

import NextAuth from 'next-auth';
import Providers from 'next-auth/providers';

const options = {
    session: {
        jwt: true,
        maxAge: 60 * 60,
    },
    callbacks: {
        async signIn(user, account, profile, req, res) {
            console.log('SIGNIN: ', user, account, profile, req, res);
            return true;
        },
        async redirect(url, baseUrl, req, res) {
            console.log('REDIRECT: ', url, baseUrl, req, res);
            return baseUrl;
        },
        async session(session, user, req, res) {
            console.log('SESSION: ', session, user, req, res);
            return session;
        },

        async jwt(token, user, account, profile, isNewUser, req, res) {
            console.log('JWT: ', token, account, req, res);
            return token;
        },
    },
    providers: [
        Providers.Credentials({
            credentials: {
                email: { label: 'email', type: 'email', placeholder: 'jdoe@email.com' },
                password: { label: 'password', type: 'password' },
            },

            async authorize(credentials, req) {
                **ENTERS HERE AND THEN CALLBACKS WHEN I SIGNIN ON LOCALHOST:PORT/API/AUTH/SIGNIN USING CHROME**
                **HOWEVER, DOES NOT ENTER HERE OR CALLBACKS USING POSTMAN**

                console.log('IN NEXT AUTH!!!');
                console.log(credentials, req);

               **REQ SHOWS UP AS UNDEFINED, SAME FOR REQ AND RES IN CALLBACKS**

                return {user: 'User'}
            },
        }),
    ],
};

export default (req, res) => NextAuth(req, res, options)

-- Please see the text in bold and caps above. Sorry if the issue is trivial but I don't know if I'm missing something...

[DNoel26]

I found the solutions to my problems:

Issues 1) and 2) were because I didn't add the csrfToken key-value pair that was showing in my Postman html form to my request body.

Issue 3) I just declared separate variables to the top of the file and saved the req and res objects there instead, which allows me to access it everywhere

[otompo]

can i see your solution for 1 and 2 please

[DNoel26]

Hi, I started by adding the following script to the 'Tests' tab under Postman Collections to see what cookies I was getting. For it to work you need to receive and pass the following three NextAuth cookies:

1. next-auth.callback-url
2. next-auth.csrf-token
3. next-auth.session-token

Script:

console.log("Response: Test script");

pm.cookies.each(cookie => console.log(cookie));
let csrfToken = pm.cookies.get("next-auth.csrf-token");
let csrfTokenValue = csrfToken.split('|')[0];
let sessionTokenValue = pm.cookies.get("next-auth.session-token");

console.log('csrf token value: ', csrfTokenValue);
console.log('session token value: ', sessionTokenValue);

pm.environment.set("csrfToken", csrfTokenValue, "<your-environment-name>");
pm.environment.set("sessionToken", sessionTokenValue, "<your-environment-name>");

Send a GET request to localhost:{{PORT}}/api/auth/signin (api/auth is default but would depend on your file structure), then check the HTML in the 'Body' tab below. You should see the csrfToken value in the form input. You can save it and persist it in an environment variable manually if you want but the script is supposed to handle that.

Next, send a POST request to localhost:{{PORT}}/api/auth/callback/credentials, be sure to include the key 'csrfToken' and its value as the variable {{csrfToken}} in the request Body tab, with x-www-form-urlencoded selected.

If it does not save the session cookie, try restarting your server and then send the POST request again. You can save the sessionToken as an environment variable manually as well, but the script is also supposed to handle that. Let me know if it works!

[ChandanPolai]

Troubleshooting Session and API Issues with NextAuth.js and Next.js

Problem 1: Session Token Shows in Browser, Not in Postman

Reason:

Session tokens are handled automatically by browsers but not in Postman.

Solution:

Manually copy the session token from the browser and add it to Postman.

Steps:

1. Log in through the browser and copy the session token from Developer Tools.
2. Add the token to Postman under the Cookies tab.
3. Test authenticated routes using Postman.

Problem 2: Postman Skipping Authorize Function and Callbacks

Reason:

Postman does not automatically handle OAuth redirects or authentication flows.

Solution:

Disable automatic redirects in Postman and manually add the session token.

Steps:

1. Disable "Automatically follow redirects" in Postman settings.
2. Add the session token manually as described above.

Problem 3: req and res Objects Undefined

Reason:

Incorrect API route configuration or missing request/response arguments.

Solution:

Ensure your API route handler correctly accepts req and res arguments.

Steps:

1. Verify your API route handler is correctly exporting a function that takes req and res.
2. If using NextAuth.js, ensure getSession or other auth functions are properly implemented.

[otompo]

Ok thanks let me try it

…

On Mon, Dec 27, 2021, 12:12 PM Darnell Noel ***@***.***> wrote: Hi, I started by adding the following script to the 'Tests' tab under Postman Collections to see what cookies I was getting. For it to work you need to receive and pass the following three NextAuth cookies: 1. next-auth.callback-url 2. next-auth.csrf-token 3. next-auth.session-token Script: console.log("Response: Test script"); pm.cookies.each(cookie => console.log(cookie)); let csrfToken = pm.cookies.get("next-auth.csrf-token"); let csrfTokenValue = csrfToken.split('|')[0]; let sessionTokenValue = pm.cookies.get("next-auth.session-token"); console.log('csrf token value: ', csrfTokenValue); console.log('session token value: ', sessionTokenValue); pm.environment.set("csrfToken", csrfTokenValue, "<your-environment-name>"); pm.environment.set("sessionToken", sessionTokenValue, "<your-environment-name>"); Send a GET request to localhost:{{PORT}}/api/auth/signin (api/auth is default and would depend on your file structure), then check the HTML in the 'Body' tab below. You should see the csrfToken value in the form input. You can save it and persist it in an environment variable manually if you want but the script is supposed to handle that. Next, send a POST request to localhost:{{PORT}}/api/auth/callback/credentials, be sure to include the key 'csrfToken' and its value as the variable {{csrfToken}} in the request Body tab, with x-www-form-urlencoded selected. If it does not save the session cookie, try restarting your server and then send the POST request again. You can save the sessionToken as an environment variable manually as well, but the script is also supposed to handle that. Let me know if works! — Reply to this email directly, view it on GitHub <#2273 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AD7GCPB4V6F6PKG2MLVWRPTUTBJHZANCNFSM47PKBCGQ> . You are receiving this because you commented.Message ID: ***@***.***>

[brodwen83]

Thank you @DNoel26 DNoel26. I did try and this worked! awesome!

here's my workaround:

First, clear all the current-request-url's cookies by this script in 'Pre-request Script'

URL: http://localhost:{{PORT}}/api/auth/signin

const jar = pm.cookies.jar();

pm.environment.unset("csrfToken");
pm.environment.unset("sessionToken");

jar.clear(pm.request.url,  function (error) {
  console.log(error);
});

under the Tests tab, get the csrfToken and put it in the Environment

pm.cookies.each(cookie => console.log(cookie));
let csrfToken = pm.cookies.get("next-auth.csrf-token");
let csrfTokenValue = csrfToken.split('|')[0];

console.log('csrf token value: ', csrfTokenValue);
postman.setEnvironmentVariable("csrfToken", csrfTokenValue);

before sending a GET request to http://localhost:{{PORT}}/api/auth/signin

Second:
URL: http://localhost:3000/api/auth/callback/credentials

you should unset the 'next-auth.session-token' in 'Pre-request Script' //always fresh cookie, so whenever there's an error, the previous cookie is always unset.

const jar = pm.cookies.jar();

jar.unset(pm.request.url, 'next-auth.session-token', function (error) {
  // error - <Error>
});

then in 'Tests' tab, paste this:

pm.cookies.each(cookie => console.log(cookie));
let sessionTokenValue = pm.cookies.get("next-auth.session-token");

console.log('session token value: ', sessionTokenValue);
postman.setEnvironmentVariable("sessionToken", sessionTokenValue);

then in the 'Body' tab add the key-value pair of your auth with key 'csrfToken' and its value as the variable {{csrfToken}} in the request Body tab, with x-www-form-urlencoded selected, nd the username/password credentials.

[alibabayev0]

Now, you can get your csrf token from this endpoint:
[GET] http://localhost:3000/api/auth/csrf
and pass them to:
[POST] http://localhost:3000/api/auth/callback/credentials

--data-urlencode 'email=example' \
--data-urlencode 'password=example' \
--data-urlencode 'csrfToken=example' \
--data-urlencode 'json=true' \
--data-urlencode 'callbackUrl=/'

[ChandanPolai]

Troubleshooting Session and API Issues with NextAuth.js and Next.js

Problem 1: Session Token Shows in Browser, Not in Postman

Reason:

Session tokens are handled automatically by browsers but not in Postman.

Solution:

Manually copy the session token from the browser and add it to Postman.

Steps:

1. Log in through the browser and copy the session token from Developer Tools.
2. Add the token to Postman under the Cookies tab.
3. Test authenticated routes using Postman.

Problem 2: Postman Skipping Authorize Function and Callbacks

Reason:

Postman does not automatically handle OAuth redirects or authentication flows.

Solution:

Disable automatic redirects in Postman and manually add the session token.

Steps:

1. Disable "Automatically follow redirects" in Postman settings.
2. Add the session token manually as described above.

Problem 3: req and res Objects Undefined

Reason:

Incorrect API route configuration or missing request/response arguments.

Solution:

Ensure your API route handler correctly accepts req and res arguments.

Steps:

1. Verify your API route handler is correctly exporting a function that takes req and res.
2. If using NextAuth.js, ensure getSession or other auth functions are properly implemented.