intermittent authentication running behind nginx proxy.

[tombburnell]

Environment

System:
OS: macOS High Sierra 10.13.4
CPU: (16) x64 Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz
Memory: 412.48 MB / 32.00 GB
Shell: 3.2.57 - /bin/bash
Binaries:
Node: 14.18.2 - ~/.nvm/versions/node/v14.18.2/bin/node
npm: 6.14.15 - ~/.nvm/versions/node/v14.18.2/bin/npm
Browsers:
Safari: 11.1
npmPackages:
next: latest => 12.0.7
next-auth: ^4.1.0 => 4.1.0
react: 17.0.2 => 17.0.2

Reproduction URL

Tricky but I can provide this later if required

Describe the issue

I have add Next-Auth working fine in my Next.js app using the github authenticator.

Today I tried to run it behind a nginx proxy so that I could put it on on the internet behind basic auth. The app loads but it behaves erratically. One minute I appear to be logged in, the next I am not. Clicking on buttons that require being logged in cause the following message to appear: "Application error: a client-side exception has occurred (see the browser console for more information).

I have NEXTAUTH_URL="http://mysite.mooo.com:4000"

The client is showing I am logged in (it has a session) but XHR requests are failing and returning {"error":"You must be sign in to add to your cart."} (this is my error)

I keep seeing errors in the log that look like this..

https://next-auth.js.org/errors#client_fetch_error invalid json response body at http://mysite.mooo:4000/api/auth/session reason: Unexpected token < in JSON at position 0 {
error: {
message: 'invalid json response body at http://mysite.mooo.com:4000/api/auth/session reason: Unexpected token < in JSON at position 0',
stack: 'FetchError: invalid json response body at http://mysite.mooo.com:4000/api/auth/session reason: Unexpected token < in JSON at position 0\n' +
' at /Users/tomburnell/github/mysite-prod/node_modules/node-fetch/lib/index.js:272:32\n' +
' at runMicrotasks ()\n' +
' at processTicksAndRejections (internal/process/task_queues.js:95:5)',
name: 'FetchError'
},
path: 'session',
header: {
'x-real-ip': '217.42.158.170',
'x-forwarded-for': '217.42.158.170',
'x-nginx-proxy': 'true',
host: 'mysite.mooo.com:4000',
connection: 'upgrade',
authorization: 'Basic dmlzaXRvcjpoYXd0aW4=',
'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36',
accept: '/',
referer: 'http://mysite.mooo.com:4000/',
'accept-encoding': 'gzip, deflate',
'accept-language': 'en-US,en;q=0.9',
cookie: '__stripe_mid=f50e0c73-195d-4685-9617-779d9bf2ad50f1f197; __stripe_sid=0812c033-98e5-4648-8d2e-df5979d564a5b9803c; next-auth.csrf-token=3ca81f07c6b5a297c6e1db40a2d74a45516da49114f15adad3673cfc2d7ca578%7C01279163a5d2ebbb4731be15b9697d661c80995545cbb9b3f09268a5cd46a868; next-auth.callback-url=http%3A%2F%mysite.mooo.com%3A4000%2F; next-auth.session-token=eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..KjJv4hO7yR2t91V0._ykNW2AdVNw1ytzOroovqfw07kqpsu7ore5jw76BifrwN0ik0NJm7Aa73ZgnNfcd8uNloVfiaLexqNTni2_HM57vglANF4GsUPEC4dGvtnvA7xbGVSEEQfIUBghG_ETil14LOQSNnLLjXT1j5PwQE-a1fCHWKZ0kq4OKEGvSnJgozyZSDPmYWF72gjLdVjsweN5vdsANlpCYxe8KwZ1g8YOg123ZGfExiR29mdyepQ7K9KKSNkkVqmC0jmCOjTeS1SAGWwFreXl5o61R0eBqYjD3uiBTi0aIUXmhkTfYzQuA9-KKCW6zg1pvmKkd6Ej0BXGdDw_ioXmfrldPfRC6qrXTwr-UVWZ7PED1Cgx3afMdbtLozVEpFamTNweTEEemBbS01-RMUXRx97mBv2nXr13E9jUxFwQjYXI.zBo6AtMU8sWk6554CwKRLQ; ph_phc_OB0ud9u8eQeSIDmKgal82BizbkylWTVEX77zC2sRYbk_posthog=%7B%22distinct_id%22%3A%2217f0857eae8982-07cc0061e111c7-36667401-384000-17f0857eae910da%22%2C%22%24device_id%22%3A%2217f0857eae8982-07cc0061e111c7-36667401-384000-17f0857eae910da%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22http%3A%2F%2Fmysite.mooo.com%3A4000%2F%22%2C%22%24referring_domain%22%3A%22mysite.mooo.com%3A4000%22%2C%22%24sesid%22%3A%5B1645120463765%2C%2217f08888d4f58f-0b5561dc9d2dbb-36667401-384000-17f08888d50167a%22%5D%2C%22%24session_recording_enabled_server_side%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D',
'if-none-match': '"34-WHZ0WLDTQ1k/AjlmXyTkcbqyk6g"'
},
message: 'invalid json response body at http://mysite.mooo.com:4000/api/auth/session reason: Unexpected token < in JSON at position 0'
}

I'm using a dynamic dns server to route requests back to my computer.

Here is my nginx config.

location / {
        auth_basic      "Administrator Area";
        auth_basic_user_file /usr/local/nginx2/conf/.htpasswd;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;

        proxy_pass http://127.0.0.1:8081;

        proxy_http_version 1.1;

        proxy_set_header Host $http_host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';

        proxy_cache_bypass $http_upgrade;
    }

Any idea what's causing it? Is it an ngnix issue or next-auth?

Thanks, Tom

How to reproduce

Run a working next-auth app behind nginx with the config above.

Expected behavior

should remain logged in

[gstrobl]

auth_basic "Administrator Area"; auth_basic_user_file /usr/local/nginx2/conf/.htpasswd;

I think this is the problem, I'm facing the same issue.

[gstrobl]

For me it's not possible to authenticate all /auth routes? Do you a solution for this?

[tombburnell]

I'm not sure I understand but I am not exposing write interface publicly so it's not an issue for me.
Essentially you need to need to make sure no Basic Authorization header is send to minio.

[gstrobl]

On client side basic_auth is working, but for next-auth handling the basic_auth is blocking the requests.

[othneildrew]

@gstrobl Did you find any reliable fixes for this yet? I'm facing the exact same issue.

I've came across this: https://www.howtogeek.com/devops/how-to-setup-basic-http-authentication-on-nginx/#:~:text=You%E2%80%99ll%20need%20to,client%20correct%20information.

But not sure how relevant it is or how to implement it.

[tombburnell]

My previous reply was actual unhelpful as it was related to a separate issue I confused.

I'm not 100% sure how I fixed it but I have turned of auth_basic for /api and /_next. This might be what fixed it for me.

 location /api/ {
        auth_basic          off; 
        ...
   }

    location /_next/ {
        auth_basic          off;
        ...
   }