Added compatibility to use behind a proxy #2493
Conversation
Added new dependency: "https-proxy-agent": "5.0.0" It is necessary for using NextAuth behind a proxy. More info on the dependecy: https://www.npmjs.com/package/https-proxy-agent
To allow use of NextAuth behind a proxy, the client now creates an "agent" with the HttpsProxyAgent library ONLY IF process.env.http_proxy has a value (so, if there is no proxy env variable set, nothing will change). The method "setAgent" from the "oauth" library is then called before every use of the method "_request" (also from the "oauth" library). "setAgent" was created on version 0.9.15 of the "oauth" libraryt and is the way to set proxy in node-auth (see, for example, issue ciaranj/node-oauth#307).
In case the url sent to the "_request" method from "node-oauth" has an HTTP protocol and not an HTTPS protocol, "node-oauth" will use the "http" library, not the "https" library, as can be seen in: https://github.com/ciaranj/node-oauth/blob/a7f8a1e21c362eb4ed2039431fb9ac2ae749f26a/lib/oauth2.js#L61-L68 In that case, the "HttpProxyAgent" library should be used to create the "agent", not the "HttpsProxyAgent" library. But, in NextAuth case, we are dealing in a more controlled scenario, so we can assume that ANY provider will have an HTTPS url. If not, it will probably be a custom Provider running in a local network, in which case there will be no need to configure an Proxy anyway. Because of that, the "agent" will only be created if the url has an "https:" protocol and the "http_proxy" env variable was set. To validate the protocol, i'm using the same validation made on the "node-oauth" library: https://github.com/ciaranj/node-oauth/blob/a7f8a1e21c362eb4ed2039431fb9ac2ae749f26a/lib/oauth2.js#L64
|
This pull request is being automatically deployed with Vercel (learn more). 🔍 Inspect: https://vercel.com/nextauthjs/next-auth/CAUR2646Rr9Q9yMWYbpgEorTzuHw |
|
Thanks, but as a heads up, |
Great! Do you think you will be able to review my PR before the next major version release? The issue is blocking the use of NextAuth on my project 😓😓 |
|
Unfortunately I don't think it is worth the effort, but I could recommend this package to get it working for you https://www.npmjs.com/package/patch-package Also, rather opening an issue report with a reproduction of your problem would have been really helpful, instead of starting with the PR. 😳 |
Auth don't work behind a proxy, to reproduce it's only necessary to use NextAuth behind a proxy and try to log in with any provider (Google, GitHub...). I will take a look in your suggestion. Thanks! |
Added compatibility to use behind a proxy
Reasoning 💡
NextAuth don't work behind a proxy.
NextAuth makes use of the "node-auth" library (npm package "oauth") in it's "oAuthClient" (src/server/lib/oauth/client.js), on methods "getOAuth2AccessToken" and "getOAuth2".
To make requests on its OAuth2 implementation, "node-auth" makes use of the "https" library. To make "https" work behind an Proxy, a new dependency was added: "https-proxy-agent".
The NextAuth client now creates an "agent" with the "HttpsProxyAgent" library before every use of the method "_request" (from the "node-auth" library), ONLY IF the "http_proxy" env variable was set. It will check if "process.env.http_proxy" has a value. If there is no proxy env variable set, nothing will change in the way NextAuth behaves today.
After creating the "agent", the method "setAgent" from the "node-auth" library is called. "setAgent" was created on version 0.9.15 of the "node-auth" library and is the way to make "node-auth" work behind an Proxy (see, for example, issue ciaranj/node-oauth#307).
About the use of the "https" library by "node-auth":
In case the url sent to the "_request" method from "node-oauth" has an HTTP protocol and not an HTTPS protocol, "node-oauth" will use the "http" library, not the "https" library, as can be seen in:
https://github.com/ciaranj/node-oauth/blob/a7f8a1e21c362eb4ed2039431fb9ac2ae749f26a/lib/oauth2.js#L61-L68
In that case, the "HttpProxyAgent" library should be used to create the "agent", not the "HttpsProxyAgent" library.
But, in NextAuth case, we are dealing in a more controlled scenario, so we can assume that ANY provider will have an HTTPS url.
If not, it will probably be a custom Provider running in a local network, in which case there will be no need to configure an Proxy anyway.
Because of that, the "agent" will only be created if the url has an "https:" protocol and the "http_proxy" env variable was set.
To validate the protocol, i'm using the same validation made on the "node-oauth" library:
https://github.com/ciaranj/node-oauth/blob/a7f8a1e21c362eb4ed2039431fb9ac2ae749f26a/lib/oauth2.js#L64
Checklist 🧢
I did not create any new test case, but the solution was tested.
Affected issues 🎟
No issue was created before the creation of this PR.