"redirect mismatch" when redirect not specified, "no access token provided" when it is

[BorisTheTripper]

Provider type

GitHub

Environment

System:
OS: Windows 10 10.0.22621
CPU: (8) x64 Intel(R) Core(TM) i5-9300HF CPU @ 2.40GHz
Memory: 3.40 GB / 15.92 GB
Binaries:
Node: 16.18.0 - C:\Program Files\nodejs\node.EXE
npm: 8.19.2 - C:\Program Files\nodejs\npm.CMD
pnpm: 8.3.1 - ~\AppData\Local\pnpm\pnpm.EXE
Browsers:
Chrome: 116.0.5845.188
Edge: Spartan (44.22621.2283.0), Chromium (116.0.1938.81)
Internet Explorer: 11.0.22621.1
Packages:
next: 13.4.9
react: 18.2.0
next-auth: 4.23.0

Reproduction URL

https://github.com/BorisTheTripper/nextauth-token-error

Describe the issue

This setup uses an Express.js endpoint instead of the usual Next.js kind. The endpoint is based on this comment. Also, in order to make requests from a Next.js app to an Express.js server, I added a rewrites() into the Next.js config (over here).

The endpoint itself seems to work, but two issues arise when trying to sign in with GitHub

1. when the redirect_uri is not specified in the auth options, you'll get a redirect_uri_mismatch error
2. when you do specify it, you'll get a no access token provided error

P.S.: I haven't checked with other providers, so I'm only including GitHub here. I suspect it may happen with others, too.

How to reproduce

The steps below will help reproduce the second error ("no access token provided"). To see the first error, comment out the authorization param in packages/api/src/auth/options.ts (over here) and follow these same steps.

1. git clone https://github.com/BorisTheTripper/nextauth-token-error.git

2. (Optionally) change the existing oauth credentials in .env with your own. If you do, make sure to configure your app as follows:

   

3. pnpm install

4. pnpm run dev

5. Go to localhost:3000 while watching the terminal logs. If you see an ECONNREFUSED error, just go to apps/server/src/main.ts (over here), edit the file slightly & save to trigger nodemon one more time. After this, refresh the broser page & you should see NextAuth logs in the server app.

6. Click "sign in" button & watch what happens in the logs as you attempt to sign in.

Expected behavior

Auth should work.