Unclear why Credentials Provider fails with Database Adapter

[swordensen]

What is the improvement or update you wish to see?

The documentation found here https://authjs.dev/getting-started/authentication/credentials and here https://authjs.dev/getting-started/providers/credentials

Does not include any warnings about trying to use credentials provider with a database adapter.

The fact that it's not supported is totally okay, especially considering the stance against using the Credentials provider.

That being said, email/password login is required for my app and it took my several hours to understand why the session object was not being retrieved.

Also next-auth fails setting the session token silently. The only way I discovered the source of my problems is when I turned on debug mode and found this error message:

UnsupportedStrategy: Signing in with credentials only supported if JWT strategy is enabled. Read more at https://errors.authjs.dev#unsupportedstrategy

Is there any context that might help us understand?

Basically, for some reason credentials provider only works with JWT tokens and not database session tokens.

Interestingly, this information is available here: https://next-auth.js.org/providers/credentials but, not on the authjs website. I honestly did not know they were connected.

Does the docs page already exist? Please link to it.

https://authjs.dev/getting-started/authentication/credentials

[patelvivekdev]

Is their anyway around here?

Like I want to combine OAuth with Credentials, I manage to do that but it only works with JWT.

[julianortlieb]

The ai of the documentation has following awnser:

But I don't understand this argument, because you can decrypt or hash passwords?

[swordensen]

To be clear; I did not make this issue to discuss the merits of the decision made by the auth.js maintainers. I trust they have good reasons for not supporting credentials and database stored sessions.

I just think it should be very clearly documented because it is easy to assume that it would be supported.

[ThangHuuVu]

thanks for the feedback, actually it's a bit deeper in the documentation, you have to look at this page: https://authjs.dev/reference/core/providers/credentials#default-1

Hope that the explanation is clear enough!

It comes with the constraint that users authenticated in this manner are not persisted in the database, and consequently that the Credentials provider can only be used if JSON Web Tokens are enabled for sessions.
The functionality provided for credentials-based authentication is intentionally limited to discourage the use of passwords due to the inherent security risks of the username-password model
...

[swordensen]

@ThangHuuVu I understand that the notice is available deeper in the documentation.

Maybe I was not clear. I made this issue because I think the warning should be included in the credentials auth guide. Specifically the pages I linked above.

I think most new auth.js users will be following the guide and because the warning is not mentioned and that using database sessions with credentials fails silently by default people will continue to be confused like myself.

[ThangHuuVu]

@swordensen that's fair, PR is welcome to improve the Getting Started doc 🙌 for the “silently” part, I’d say we already have the debugging guide at the top of our Guide submenu, so that should be enough 🤔

[swordensen]

@swordensen that's fair, PR is welcome to improve the Getting Started doc 🙌 for the “silently” part, I’d say we already have the debugging guide at the top of our Guide submenu, so that should be enough 🤔

Okay! I am more than happy to make a PR :)

I will reference this issue though. I'm not sure if it should remain closed

[swordensen]

done and done. I agree that the failing silently is documented well enough! I just added a small comment to the credentials section.

I think these small changes would be sufficient to prevent others from going down the wrong path like I did.