Apple provider always redirects to 'baseUrl' (NEXTAUTH_URL) instead of 'callbackUrl'

[yuzhakovvv]

When user uses Apple provider he's redirected to baseUrl (NEXTAUTH_URL) instead of callbackUrl that was passed to signIn() method. Google provider works as expected and redirects to callbackUrl.

Sign In is successful as app gets user data from Apple. callbacks work as expected. Custom callbacks.redirect returns correct callbackUrl.

What can affect callbackUrl to be changed to baseUrl (NEXTAUTH_URL) after callbacks.redirect? Maybe you can point a line in the source code?

[wescarr]

I am having the same issue. I believe this is because Apple redirects back to /api/auth/callback/apple with a POST request which does NOT send the __Secure-next-auth.callback-url cookie in the request. Other providers, like Google, do the callback with a GET request.

IMO using a cookie to store the callbackUrl is a mistake, as it also does not work for the email provider, especially if want to use a different browser/session from where you provided your email address.

[balazsorban44]

One workaround is to adjust the cookie options to be able to use the cookie, similar to as described here:

#1664 (comment)

I can see why this is problematic. Not using cookies would mean that we should rely on some other mechanism for storing information. Currently I don't have a better idea, but open for suggestions! 🙂

[wescarr]

@balazsorban44 thanks for your response. I believe a common pattern is to add the callback url as a query param to the redirect_uri sent to OAuth providers. Granted, I am not an expert on the security implications of that approach. Do you have thoughts/feedback on this approach?