Fix: 13142 - Replace only the pathname from signin to callback instead of the whole url

apps/dev/nextjs/app/login/page.tsx

@@ -0,0 +1,42 @@
+import { signIn, auth } from "auth"
+import { SessionProvider } from "next-auth/react"
+import Client from "../client"
+export default async function Page() {
+  const session = await auth()
+
+  return (
+    <div className="container">
+      <h1>Login Form Sample</h1>
+      <p>This sample shows how to login using `auth` module with custom form</p>
+      <div className="card">
+        <div className="card-header">
+          <h3> Login </h3>
+        </div>
+        <div className="card-body">
+          {session ? (
+            <pre>{JSON.stringify(session, null, 2)}</pre>
+          ) : (
+            <form
+              action={async (formData) => {
+                "use server"
+                await signIn("credentials", formData)
+              }}
+            >
+              <input
+                id="password"
+                type="password"
+                name="password"
+                placeholder="Enter password"
+                required
+                minLength={6}
+              />
+              <div className="btn-wrapper">
+                <button>Sign In</button>
+              </div>
+            </form>
+          )}
+        </div>
+      </div>
+    </div>
+  )
+}

apps/dev/nextjs/app/styles.css

@@ -82,11 +82,7 @@ main {
   }
 
   .card-body {
-    padding-bottom: 1.1rem;
-
-    &:has(button) {
-      padding: 1.1rem;
-    }
+    padding: 1.1rem;
   }
 
   .card-footer {
@@ -129,4 +125,21 @@ main {
   button:hover {
     background-color: #ccc;
   }
+
+  input {
+    padding: 0.7rem 0.8rem;
+    border: 1px solid #ccc;
+    border-radius: 0.5rem;
+    font-size: 1rem;
+    line-height: 1.4rem;
+    background-color: #fff;
+    color: black;
+    margin-bottom: 1rem;
+  }
+
+  input:focus {
+    outline: none;
+    border-color: #999;
+    background-color: #fafafa;
+  }
 }

apps/dev/nextjs/components/header.tsx

@@ -48,6 +48,9 @@ export function Header({
           <Link className={styles.navItem} href="/dashboard">
             Dashboard (app)
           </Link>
+          <Link className={styles.navItem} href="/login">
+            Login (app)
+          </Link>
           <Link className={styles.navItem} href="/policy">
             Policy (pages)
           </Link>

apps/dev/nextjs/package.json

@@ -11,10 +11,10 @@
   },
   "license": "ISC",
   "dependencies": {
-    "next": "15.3.1",
+    "next": "15.4.5",
     "next-auth": "workspace:*",
-    "react": "19.0.0-rc-4c58fce7-20240904",
-    "react-dom": "19.0.0-rc-4c58fce7-20240904"
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0"
   },
   "devDependencies": {
     "@types/react": "^18.2.23",

packages/next-auth/src/lib/actions.ts

@@ -63,7 +63,9 @@ export async function signIn(
   }
 
   if (foundProvider.type === "credentials") {
-    url = url.replace("signin", "callback")
+    const urlObj = new URL(url)
+    urlObj.pathname = urlObj.pathname.replace("signin", "callback")
+    url = urlObj.href
   }
 
   headers.set("Content-Type", "application/x-www-form-urlencoded")

packages/next-auth/test/actions.test.ts

@@ -1,8 +1,17 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest"
+import {
+  describe,
+  it,
+  expect,
+  vi,
+  beforeEach,
+  afterEach,
+  beforeAll,
+} from "vitest"
 import NextAuth, { NextAuthConfig } from "../src"
 // TODO: Move the MemoryAdapter to utils package
 import { MemoryAdapter } from "../../core/test/memory-adapter"
 import Nodemailer from "@auth/core/providers/nodemailer"
+import Credentials from "@auth/core/providers/credentials"
 
 let mockedHeaders = vi.hoisted(() => {
   return new globalThis.Headers()
@@ -106,4 +115,33 @@ describe("signIn action", () => {
       )
     })
   })
+  describe("with credentials provider", () => {
+    beforeEach(() => {
+      nextAuth = NextAuth({
+        ...config,
+        providers: [
+          Credentials({
+            credentials: { password: { label: "Password", type: "password" } },
+            authorize(c) {
+              if (c.password !== "password") return null
+              return {
+                id: "test",
+                name: "Test User",
+                email: "[email protected]",
+              }
+            },
+          }),
+        ],
+      })
+    })
+    it("follow redirects and callback signin", async () => {
+      await nextAuth?.signIn("credentials", { password: "password" })
+      expect(mockRedirect).toHaveBeenCalledWith("http://localhost/")
+    })
+    it("only replaces signin on path name", async () => {
+      process.env.AUTH_URL = "http://signin"
+      await nextAuth?.signIn("credentials", { password: "password" })
+      expect(mockRedirect).toHaveBeenCalledWith("http://signin/")
+    })
+  })
 })