NextAuth 身份验证错误：“状态 cookie 丢失。”

Question

NextAuth 身份验证错误：“状态 cookie 丢失。”

我使用 Next.js 和 NextAuth 进行 OAuth2 身份验证。这是代码片段：

import NextAuth from 'next-auth';
import DiscordProvider from 'next-auth/providers/discord';
import jwt from 'jsonwebtoken';

export default NextAuth({
    debug: true,
    providers: [
        DiscordProvider({
            clientId: process.env.DISCORD_CLIENT_ID || "",
            clientSecret: process.env.DISCORD_CLIENT_SECRET || "",
            authorization: { params: { scope: 'identify' } }
        }),
    ],
    secret: process.env.NEXTAUTH_SECRET,
    cookies: {
        sessionToken: {
            name: `__Secure-next-auth.session-token`,
            options: {
                httpOnly: true,
                sameSite: 'lax',
                path: '/',
                secure: process.env.NODE_ENV === 'production',
                domain: process.env.NODE_ENV === 'production' ? 'domain.com' : undefined
            }
        }
    },
    callbacks: {
        async jwt({ token, account, profile }) {
            // something here
            return token;
        },
        async session({ session, token }) {
            const new_token = token as unknown as Haurto_Token_Decoded;
            if (new_token) {
               // something here
            }
            return session;
        },
        async redirect({ url, baseUrl }) {
            if (url.startsWith(baseUrl)) {
                return url;
            }
            return baseUrl;
        }
    },



    pages: {
        signIn: '/',
        signOut: '/',
        error: '/uhh',
    }
});

但是，当重定向到

/api/auth/callback/[provider]

时，我在后端遇到以下错误：

[next-auth][error][OAUTH_CALLBACK_ERROR] 
https://next-auth.js.org/errors#oauth_callback_error State cookie was missing. {  
  error: TypeError: State cookie was missing.
      at Object.use (D:\Code\GitHub files\Website-Dashboard\node_modules\next-auth\core\lib\oauth\checks.js:111:23)
      at oAuthCallback (D:\Code\GitHub files\Website-Dashboard\node_modules\next-auth\core\lib\oauth\callback.js:89:25)
      at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
      at async Object.callback (D:\Code\GitHub files\Website-Dashboard\node_modules\next-auth\core\routes\callback.js:52:11)
      at async AuthHandler (D:\Code\GitHub files\Website-Dashboard\node_modules\next-auth\core\index.js:208:28)
      at async NextAuthApiHandler (D:\Code\GitHub files\Website-Dashboard\node_modules\next-auth\next\index.js:22:19)
      at async NextAuth._args$ (D:\Code\GitHub files\Website-Dashboard\node_modules\next-auth\next\index.js:108:14)
      at async K (D:\Code\GitHub files\Website-Dashboard\node_modules\next\dist\compiled\next-server\pages-api.runtime.dev.js:21:2871)
      at async U.render (D:\Code\GitHub files\Website-Dashboard\node_modules\next\dist\compiled\next-server\pages-api.runtime.dev.js:21:3955)
      at async DevServer.runApi (D:\Code\GitHub files\Website-Dashboard\node_modules\next\dist\server\next-server.js:600:9)
      at async NextNodeServer.handleCatchallRenderRequest (D:\Code\GitHub files\Website-Dashboard\node_modules\next\dist\server\next-server.js:269:37)
      at async DevServer.handleRequestImpl (D:\Code\GitHub files\Website-Dashboard\node_modules\next\dist\server\base-server.js:816:17)
      at async D:\Code\GitHub files\Website-Dashboard\node_modules\next\dist\server\dev\next-dev-server.js:339:20
      at async Span.traceAsyncFn (D:\Code\GitHub files\Website-Dashboard\node_modules\next\dist\trace\trace.js:154:20)
      at async DevServer.handleRequest (D:\Code\GitHub files\Website-Dashboard\node_modules\next\dist\server\dev\next-dev-server.js:336:24) {
    name: 'OAuthCallbackError',
    code: undefined
  },
  providerId: 'discord',
  message: 'State cookie was missing.'
}

错误指出“状态 cookie 丢失”，但我不记得配置过与 cookie 相关的任何内容。

我尝试设置

checks: ['none']

进行测试，绕过了CSRF保护机制，错误消失了。但是，禁用此功能会损害安全性，因此这不是一个可行的解决方案。

我也设置了各种环境变量并尝试了不同的方法来解决这个问题，但都没有效果。我搜索了很多论坛，但没有找到合适的解决方案。

{
    "next": "14.2.4",
    "next-auth": "^4.24.7",
},

任何帮助将不胜感激。谢谢！

Answer 1

问题存在的原因可能有多种。其中之一是在您的应用程序和客户之间使用代理/缓存。例如，如果您使用 Cloudflare，请确保所有对

/api/auth/*

的请求都绕过缓存。