Calculate NEXTAUTH_URL based on incoming request

[buehler]

Description 📓

Setting the NEXTAUTH_URL environment variable seems unnecessary in certain environments. For example, when running a next app on google cloud run, the URL of the application is only available after the first deployment. Therefore, to create preview deployments, one needs to deploy an application twice. First, without the URL env, and after the url is available, a second time with the NEXTAUTH url var set.

As I'm aware of, other frameworks like ASP.Net do calculate the current host based on the incoming request. Would it be possible to do the same for next auth as well?

The calculation of ASP.net even works with proxies since the framework does respect X-Forwarded-For headers.

Then, one could remove the need of this variable altogether or just use it to overwrite the calculation for good.

How to reproduce ☕️

Create a nextjs app with next auth (let's say a google login), and try to deploy it on google cloud run.

Contributing 🙌🏽

No, I am afraid I cannot help regarding this

[balazsorban44]

This is currently only supported when deploying to Vercel. We cannot blindly trust request headers.

https://next-auth.js.org/deployment#vercel

An environment variable or other methods are necessary.

Currently we detect if VERCEL exists and then trust the host.

See:
https://next-auth.js.org/deployment#vercel

next-auth/packages/next-auth/src/next/utils.ts

Lines 18 to 23 in 8b6d2e3

	export function detectHost(forwardedHost: any) {
	// If we detect a Vercel environment, we can trust the host
	if (process.env.VERCEL) return forwardedHost
	// If `NEXTAUTH_URL` is `undefined` we fall back to "http://localhost:3000"
	return process.env.NEXTAUTH_URL
	}