TwitterProvider generates wrong authorization URL

[kf106]

Description 🐜

The TwitterProvider GET_AUTHORIZATION_URL starts with [object Object] rather than a URL, and authorization subsequently fails.

[next-auth][debug][GET_AUTHORIZATION_URL] {
  url: '[object Object]?oauth_token=XXXXXX&oauth_token_secret=XXXXXXX&oauth_callback_confirmed=true'
}

Is this a bug in your own project?

No

How to reproduce ☕️

Follow the Twitter code example at https://next-auth.js.org/providers/twitter

Screenshots / Logs 📽

+

Environment 🖥

System:
OS: Linux 5.11 Ubuntu 20.04.3 LTS (Focal Fossa)
CPU: (8) x64 Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz
Memory: 1.82 GB / 15.56 GB
Container: Yes
Shell: 5.0.17 - /bin/bash
Binaries:
Node: 14.17.6 - ~/.nvm/versions/node/v14.17.6/bin/node
npm: 7.22.0 - ~/.nvm/versions/node/v14.17.6/bin/npm
Browsers:
Brave Browser: 93.1.29.81
Chrome: 94.0.4606.54
Firefox: 92.0
npmPackages:
next: ^11.1.2 => 11.1.2
next-auth: 4.0.0-beta.3 => 4.0.0-beta.3
react: ^17.0.2 => 17.0.2

Contributing 🙌🏽

No, I am afraid I cannot help regarding this

[kf106]

Note: this is in next-auth 4.0.0-beta.3

[balazsorban44]

It has to be a configuration error somewhere, I just tested it and I logged in successfully:

Could you paste in your [...nextauth].js file?

[kf106]

[...nextauth].js.txt

[kf106]

If I change line 49 of node_modules/next-auth/server/lib/oauth/authorization-url.js to

      const url = `${provider.authorization.url}?${new URLSearchParams({

it works. By adding the .url to provider.authorization

[kf106]

Are you looking at 4.0.0-beta.3? I've just rm -fr node_modules and run npm install and my package.json has "next-auth": "4.0.0-beta.3", - and - I see the lines for const url = ... on line 48.

[kf106]

Yes, I have the same string on line 14 of twitter.js

[kf106]

But if I put a console.log(provider.authorization) in authorization-url.js just before the const url line, I get:

{ url: 'https://api.twitter.com/oauth/authenticate', params: {} }
[next-auth][debug][GET_AUTHORIZATION_URL] {
  url: '[object Object]?...

So by the time it gets there, it's been changed to an object. I don't even know where I would override it in my code.

[kf106]

BTW, LinkedIn, Facebook and Github are working fine.

[balazsorban44]

Found it, my bad! #2842

introduced a normalization. So internally we can always assume authorization.url to be the correct place. I still don't understand how it works for me, but I'll open a PR to fix this. 👀 Thank you for catching!

[kf106]

You're welcome. Any ETA on 4.0.0-beta.4 ?

[balazsorban44]

Will do a quick release when #2884 has been reviewed since it was a bug that affects all Twitter provider users.

[balazsorban44]

Should be released now! https://github.com/nextauthjs/next-auth/releases/tag/v4.0.0-beta.4

[kf106]

Thank you, and also thank you for the excellent work you're doing providing this module. I wouldn't want to have to code all of this up from scratch.