fix: ignore / for NEXTAUTH_URL path, infer NEXTAUTH_SECRET (#9955)

fix: ignore `/` for `NEXTAUTH_URL` path, detect `NEXTAUTH_SECRET`

Author: balazsorban44

packages/next-auth/src/lib/env.ts

@@ -15,12 +15,17 @@ export function reqWithEnvURL(req: NextRequest): NextRequest {
  * For backwards compatibility, `next-auth` checks for `NEXTAUTH_URL`
  * and the `basePath` by default is `/api/auth` instead of `/auth`
  * (which is the default for all other Auth.js integrations).
+ *
+ * For the same reason, `NEXTAUTH_SECRET` is also checked.
  */
 export function setEnvDefaults(config: NextAuthConfig) {
   try {
+    config.secret ??= process.env.AUTH_SECRET ?? process.env.NEXTAUTH_SECRET
     const url = process.env.AUTH_URL ?? process.env.NEXTAUTH_URL
     if (!url) return
-    config.basePath ||= new URL(url).pathname
+    const { pathname } = new URL(url)
+    if (pathname === "/") return
+    config.basePath ||= pathname
   } catch {
   } finally {
     config.basePath ||= "/api/auth"