RFC: Switch core to `auth.js` and coordinate collaboration / transition of this module into `auth.js`

[BracketJohn]

Describe the feature

We want to:

• switch to an auth.js core to be fully react independent
• coodinate a merge / collab with auth.js with @balazsorban44
• Switch to using h3 sessions and not nuxt-session

Additional information

No response

[BracketJohn]

Tasks / issues related / resolved by auth.js move:

• Property default does not exist (CredentialsProvider.default) #119 .default does not exist: With auth.js this problem was resolved
• Ideas to more explicit with the next-auth providers dependencies #99 add @auth/core as an explicit dependency to avoid problems related to hoisting
  • resolved by Make next-auth peer dep #179
• wrong icons/logos url #151
• may adress: Build error with "cloudflare-pages"  #170

Will expand this as issues come up.

[austins]

The icons/logos were fixed in next-auth@4.18.8 as well, would upgrading to that version be an appropriate fix for #131 in the meantime until the switch to @auth/core?

[kilakewe]

+1 issue with cloudflare based deployment.

[BracketJohn]

Hey @austins 👋

We downstreamed the fix in 0.4.0 - use the latest alpha to see it working. In general, next-auth is now a peer dependency, hence you have a choice of which version you want to install (:

+1 issue with cloudflare based deployment.

Thanks (:

[BracketJohn]

Current blockers before fully migrating

• AFAIK auth.js only allows trustHost: true - which seriously lowers security, see [1]

[1] assert check that forces us to set trustHost: true
https://github.com/nextauthjs/next-auth/blob/6c07331cc53abe45c644308af6b6f2de29fdae2e/packages/core/src/lib/assert.ts#L74-L76

[tmlmt]

What are the news on this?

[zoey-kaiser]

What are the news on this?

Same issue as mentioned by @BracketJohn here still persists. I am staying up to date on this switch, but we don't want to switch to authjs, until the team behind it themselves classify authjs as ready for production.
As long as it stays experimental, we do not feel comfortable making the switch!

[septatrix]

• AFAIK auth.js only allows trustHost: true - which seriously lowers security, see [1]

Is there an upstream issue about resolving this which one can follow?

[BracketJohn]

closed as part of cleanup (:

note that this does not mean that it is unplanned, but there will be a new/separate issue later on