Missing documentation on authorization-option

[doctorstones]

What is the improvement or update you wish to see?

In this page: https://next-auth.js.org/configuration/providers/oauth#authorization-option it's missing the information and/or a code example about the request? option, which could hopefully solve some problems like mine in a non perfect-compliant oauth2 environment.

Is there any context that might help us understand?

In my case, which is not a perfect ouath2 compliant environment, I have to do a POST (non-GET) request when calling the authentication API, and seems to me that this option isn't explicit in url/params option.
The request parameter in authentication options could make it but it's not clear how to use it.

Does the docs page already exist? Please link to it.

https://next-auth.js.org/configuration/providers/oauth#authorization-option

[balazsorban44]

This is currently not something that NextAuth.js supports. The method is not documented, because it does not exist. This should be a feature request then.

But you are correct, the spec says the authorization endpoint MUST support GET: https://datatracker.ietf.org/doc/html/rfc6749#section-3.1:~:text=The%20authorization%20server%20MUST%20support%20the%20use%20of%20the%20HTTP%20%22GET%22

So I wonder what OAuth server are you using?

[doctorstones]

@balazsorban44 thanks for your quick reply.
You're right, specs says that auth endpoint MUST support get, but I don't have control on this and I'm just searching for a workaround.
The OAuth server is an internal one for test purpouses.

BTW, also if not supported I've found it in the types of the library: more than a feature request, could it be something that is present but it's never used? Just in case, could it be used?

[balazsorban44]

In that case, the type is incorrect then.

Basically this:

https://github.com/panva/node-openid-client/blob/29717da984115dfe8475a31496f144bf52a98ad2/lib/client.js#L263-L282

Should be mixed in here:

next-auth/packages/next-auth/src/core/routes/signin.ts

Lines 26 to 27 in 4d4c276

	const response = await getAuthorizationUrl({ options, query })
	return response

POST to the authorization endpoint would return some HTML with a self-submitting form.

I don't intend to work on this, as supporting non-conform OAuth providers explicitly is not our priority and would like to push on the custom in-house implementation to have a look at supporting the spec correctly instead.

Feel free to work on this if you would like.