Session callback is not triggered with Cloudflare

[misway]

Hello,

When testing locally dev, both versions work fine. However, when I deploy them to Cloudflare Pages, v0.1.8 works without any issues, but v0.1.9 ~ v0.2.0-beta.1 fail to maintain the authenticated state and consistently show 'unauthenticated' status.

I tried adding signIn and session callbacks, and used wrangler pages deployment tail to observe the server and console.log message. I found that signIn functions properly on both version, and I can obtain the authentication information. However, after version 0.1.9, the session callback is not being triggered.

v0.1.8
https://github.com/misway/authjs018
https://authjs018.pages.dev/

POST https://authjs018.pages.dev/api/auth/signin/google? - Ok
GET https://authjs018.pages.dev/api/auth/callback/google?code=4%REDACTED&scope=email+profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile&authuser=0&prompt=none - Ok

  (log) signIn called
  (log) { ... profile content ... }

GET https://authjs018.pages.dev/ - Ok

  (log) session called
  (log) { ... session content ... }

v0.1.10
https://github.com/misway/authjs0110
https://authjs0110.pages.dev/

POST https://authjs0110.pages.dev/api/auth/signin/google? - Ok
GET https://authjs0110.pages.dev/api/auth/callback/google?code=4%REDACTED&scope=email+profile+openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&authuser=0&prompt=none - Ok

  (log) signIn called
  (log) { ... profile content ... }

GET https://authjs0110.pages.dev/ - Ok
GET https://authjs0110.pages.dev/api/auth/session - Ok
GET https://authjs0110.pages.dev/ - Ok

[Hebilicious]

Can you make sure that you're using the same version of auth.js/core in your lockfiles on cloudflare pages?

There's isn't anything I can think of that could cause this weird callback behaviour between 0.1.8 and 0.1.9, as these changes were just related to cookies v0.1.8...v0.1.9

However the session not working might be due to the way cloudflare handles cookies and h3 splitCookieString not working on cloudflare...

In the meantime, I will try to switch back to set-cookie-parser to see if it fixes your issue.

[misway]

Can you make sure that you're using the same version of auth.js/core in your lockfiles on cloudflare pages?

Yes, the versions of @auth/core in the lockfiles of both test websites are 0.9.0.
By the way, if I update @auth/core to 0.10.0, it will cause an error when installing authjs-nuxt. That's why I always make sure to keep it at version 0.9.0.

In the meantime, I will try to switch back to set-cookie-parser to see if it fixes your issue.

Thank you for your assistance. I will report the situation again when it's released.

[Hebilicious]

Thanks, for your report @misway, I believe I found the root cause of the issue :
It appears that setting a multiple value header with event.node.res.appendHeader isn't properly supported by some of the Nitro presets, which is why it works locally and before 0.1.9, where some of the cookies were discarded.

Actually it's already fixed in the latest version of Nitro, if you're using pnpm you should be able to do this in your package.json (there's an equivalent syntax for npm and yarn)

  "pnpm": {
    "overrides": {
      "nitropack": "npm:nitropack-edge@latest"
    }
  }

Here's a working demo with latest auth.js-nuxt and nitropack-edge : https://authjs-cookie.pages.dev/

[misway]

I am not familiar with this usage, and trying to add the following syntax in package.json with npm did not work.

  "overrides": {
    "nitropack": {
      "nitropack-edge": "^2.6.0-28165667.2f114e5"
    }
  }

I will try again the next time NitroPack is released. Thank you for your time🙏🏽

[Hebilicious]

This will work with npm :

{
  "dependencies": {
    "nuxt": "latest",
  },
  "overrides": {
    "nitropack": "npm:nitropack-edge@latest"
  }
}

[misway]

I have updated the package.json in demo, but still not work.

[Hebilicious]

Update authjs-nuxt to latest too.
My full working package.json :

{
  "name": "nuxt-app",
  "private": true,
  "scripts": {
    "build": "nuxt build",
    "dev": "nuxt dev",
    "generate": "nuxt generate",
    "preview": "nuxt preview",
    "postinstall": "nuxt prepare"
  },
  "devDependencies": {
    "@types/node": "^18.16.19",
    "nuxt": "^3.6.3"
  },
  "dependencies": {
    "@auth/core": "^0.9.0",
    "nitropack": "npm:nitropack-edge@latest",
    "@hebilicious/authjs-nuxt": "link:../authjs-nuxt/packages/authjs-nuxt"
  },
  "pnpm": {
    "overrides": {
      "nitropack": "npm:nitropack-edge@latest"
    }
  }
}

[Hebilicious]

This is fixed in the latest version

[misway]

Until version 0.3.0 beta2, I still encountered the same issue in CFP. I have already used the suggested package.json configuration with NPM.

  "devDependencies": {
    "nuxt": "^3.6.5",
    "@types/node": "^20.5.0"
  },
  "dependencies": {
    "@auth/core": "0.10.0",
    "h3": "1.8.0-rc.3",
    "nitropack": "npm:nitropack-edge@latest",
    "@hebilicious/authjs-nuxt": "0.3.0-beta.2"
  },
  "overrides": {
    "h3": "1.8.0-rc.3",
    "nitropack": "npm:nitropack-edge@latest"
  }

In addition to this, I would also like to report a few minor issues.

The @auth/core version mentioned in the Getting started is 0.9.0, but when installing the current version of AuthJS, it requires @auth/core 0.10.0, leading to an error. Similarly, if using the latest @auth/core 0.12.0, it will also result in an error.

In earlier documentation, there were three aliases setting, but now only cookie remains.

"cookie": resolve(__dirname, "node_modules/cookie"),
"jose": resolve(__dirname, "node_modules/jose/dist/browser/index.js"),
"@panva/hkdf": resolve(__dirname, "node_modules/@panva/hkdf/dist/web/index.js")

However, CFP build will failure if jose is missing.

Error: Failed to publish your Function. Got error: Uncaught TypeError: Cannot read properties of undefined (reading 'split')
  at functionsWorker-0.6000116219389062.js:4362:32

Similarly, if @panva/hkdf is not present, when trying to authenticate by clicking on the provider name through Native Link Sign-in, an error message "Try signing in with a different account" will appear above. (This situation also occurs specifically within CFP)

[Hebilicious]

You might have issues with your dependecies/lockfile/package manager.
Here's a working demo that you can deploy on CFP

https://github.com/Hebilicious/nuxt-authjs-google
https://authjs-cookie.pages.dev/

[misway]

Thanks, I deleted the lockfile and the node_modules directory and it worked after reinstalling