OAUTH_CALLBACK_ERROR State cookie was missing

[rkreddy99]

Question 💬

Using AzureAdProvider for authentication

export const authOptions: NextAuthOptions = {
  callbacks: {
    async jwt({ token, user, account, profile }) {
      if (account) {
        token.idToken = account.id_token;
      }
      return token;
    },
    async session(params) {
      console.log("sessionUSer", params);
      return params.session;
    },
  },
  providers: [
    // Add your authentication providers here
    AzureAdProvider({
      clientId: <CLIENTID>,
      clientSecret: <CLIENTSECRET>,
      tenantId: <TID>,
    }),
  ],
};

I have tried giving authorization params as well

authorization: {
        params: {
          scope: "openid profile email",
        },
      },

Getting the error

[next-auth][error][OAUTH_CALLBACK_ERROR] 
https://next-auth.js.org/errors#oauth_callback_error State cookie was missing. {
  error: TypeError: State cookie was missing.
      at Object.use (C:\Users\rkreddy\Desktop\bitbucket\ccapp\node_modules\next-auth\core\lib\oauth\checks.js:103:23)
      at oAuthCallback (C:\Users\rkreddy\Desktop\bitbucket\ccapp\node_modules\next-auth\core\lib\oauth\callback.js:89:25)
      at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
      at async Object.callback (C:\Users\rkreddy\Desktop\bitbucket\ccapp\node_modules\next-auth\core\routes\callback.js:52:11)
      at async AuthHandler (C:\Users\rkreddy\Desktop\bitbucket\ccapp\node_modules\next-auth\core\index.js:208:28)
      at async NextAuthApiHandler (C:\Users\rkreddy\Desktop\bitbucket\ccapp\node_modules\next-auth\next\index.js:22:19)
      at async NextAuth._args$ (C:\Users\rkreddy\Desktop\bitbucket\ccapp\node_modules\next-auth\next\index.js:106:14) {
    name: 'OAuthCallbackError',
    code: undefined
  },
  providerId: 'azure-ad',
  message: 'State cookie was missing.'
}

How to reproduce ☕️

To reproduce use the above authOptions for azure ad, and use it in pages/api/auth/[...nextauth].ts file as specified in the docs.

Contributing 🙌🏽

Yes, I am willing to help answer this question in a PR

[molniya0207]

Same problem with Auth0 and VK providers. Looks like problem might be because of an Next.js update - that error doesn't happen for me on Next 13.3.0

[shiam-technext]

What was your next-auth version?

[pixxelfriend]

After updating to next: 13.5.4 and next-auth: 4.23.2 the error message does not occur anymore.

[OatsProgramming]

I have the same problem with Google and Github Providers. Opened a discussion about it ( #7403 ) but still nothing. I found something similar and tried to use the solution that was found there ( #6898 ) but it wasn't working. Even downgraded to 13.2.4: nothing.

[sajithrw]

I have the same issue with Google provider with Firebase. I am using next 13.4.2 and next-auth 4.22.1 versions. Also tried to downgrade next version to 13.2.4. Didn't work though.

Tried to define cookies with pkceCodeVerifier and state. Same result. Do we have any workaround for this issue?

[sajithrw]

Hello @ashank2603, thank you for the response. I tried adding below, but it didn't work. Am I missing something?

callbacks: { async redirect({ url, baseUrl }) { return baseUrl }, },

[ashank2603]

Can you show your whole authOptions object?

[mavdotso]

This one worked for me.

Thanks so much @ashank2603!

[Tanmayyy209]

Have got the same error with google provider still stuck over there please help

[vitorsorato]

same here, Google provider..

[atomcat1978]

Had this exact same error recently in production. We have a brokered login in out auth solution, and found many of these errors in the logs:

[next-auth][error][OAUTH_CALLBACK_ERROR]
https://next-auth.js.org/errors#oauth_callback_error State cookie was missing. {
  error: TypeError: State cookie was missing.
      at Object.use (/usr/src/app/node_modules/next-auth/core/lib/oauth/checks.js:103:23)
      at oAuthCallback (/usr/src/app/node_modules/next-auth/core/lib/oauth/callback.js:89:25)

I could reproduce the problem in windows + latest Edge by the following steps:

• start Egde
• log in
• close edge without logging out
• start Edge again
• log in again (Edge does not pick up the previous auth session as Chrome does for example)
• after the brokered login this error appears n nextJs log

[simonecervini]

I have tried this step sequence and am unable to reproduce the problem. The only difference is that I used Mac.

I still keep seeing the same error in the logs in production.

If you can reproduce it, does it change anything by using absolute versus relative callbackUrls? That seems to be the only concrete observation that came out of this discussion.

[atomcat1978]

Hi,

We have solved the problem partially after I figured out that we had a redirect in our load balancer, which redirected traffic from www.ourdomain.com to ourdomain.com - which certainly screwed up all the cookies for someone who used www.ourdomain.com. We turned it into a rewrite, so the browser jumps over to the correct domain without the www. prefix now. This has solved the problem partially, however, I still see some of these error messages in the logs.

I'll report back as soon as I (hopefully) figure out the reason we still get these messages (though in far lower numbers).

[RoboTums]

Had this problem with Auth0.
added callbacks: { async redirect({ url, baseUrl }) { return baseUrl }, } to my NextAuth authOptions object, and that fixed it for me on Next 13.3.0 + Next-Auth 4.22.1

what tripped me up is I specify the callback in the signIn method, but that doesn't redirect properly.

[vicary]

Tried the callbacks option, doesn't work.

• next@13.4.4
• next-auth@4.22.1

I am using Google OAuth via Auth0 provider.

[Tanmayyy209]

hello , have you solved this error ? I am getting the same error with google Oauth

[simonecervini]

Had this exact same error recently in production.

I'm not able to reproduce the problem, but I am experiencing a concerning error rate in production. Therefore I'm not actually sure this error is causing real problems.

• next@13.4.4 with app dir, but I'm still using API routes for next-auth (/api/auth/[...nextauth].ts)
• next-auth@4.22.1

[simonecervini]

I tried as suggested above some changes in the redirect callback, but actually I was already using a quite similar function that has remained unchanged for the last 18 months.

I also tried to unify the callbackUrls and make them all relative (and not a mix of absolute and relative), but nothing changed. Maybe I could try the opposite.

[lbowes]

What does your callbacks: block look like?

[simonecervini]

callbacks: {
    async redirect({ url, baseUrl }) {
        const redirectUrl = url.startsWith('/') ? new URL(url, baseUrl).toString() : url;
        console.log(`[next-auth] Redirecting to "${redirectUrl}" (resolved from url "${url}" and baseUrl "${baseUrl}")`);
        return redirectUrl;
    },
}

[simonecervini]

I added the console.log recently for debugging purposes and noticed that it gets called in places where you would not expect it. In this application I have a tRPC backend and next-auth is used only once to pass the session object into the application context (getServerSession()) and I noticed that the redirect is often called during mutations that have nothing to do with the sign in/sign out flow and this is clearly an error

[DuncanLHS]

Nice find. Perhaps worth recreating this as an issue then rather than discussion

[DuncanLHS]

Same error here with the Discord provider.
next-auth 4.22.1
next 13.4.4

All works fine on localhost but see the problem when deployed to vercel. Tried the redirect callback but no change.

[yutounun]

totally same here.

[AndyPandyGeek]

I've spent hours solving this issue with Next-Auth 4.22.1. Didn't work on either localhost or pm2.

Eventually upgraded from Next 13.2.4 to 13.4.4 and that solved it on both local and remote servers.
What a bummer!

[vicary]

I am on 13.4.4 but it still happens, which provider are you using?

[AndyPandyGeek]

I am on 13.4.4 but it still happens, which provider are you using?

It was a Google provider.

[amir-h-e]

i'm using google provider too, but i still have the error

[JoMaCaCha]

An app with Next 13.4.2 and Next-Auth 4.22.1, deployed on Google App Engine, had this issue when using the Google provider. In "Authorized redirect URIs" I had "https://www.example.com/api/auth/callback/google", but after adding "https://example.com/api/auth/callback/google" this issue was resolved.

[robValtech]

I am having too the same problem using Next 12.1.6 with next-auth 4.22.1 and Cognito provided.
Our provider config is fairly simple, can't see what could be done to avoid the oAuthCallback issue. This worked fine before the upgrade.

In our config we use

url.searchParams.append(
    'redirect_uri',
    `${APP_URL}/api/auth/callback/cognito`
  );

Even when the APP_URL is 'localhost:3000' (so no www. present) the issue occurs.

[rene6502]

We observe this error frequently in prod.
It is caused by an unmotivated /api/auth/callback.
The call occurs quite long after a successful login (10-70s).
Because the state cookie is deleted at the end of the login the error is reported.
I have no clue what triggers this call.
We are using next:12.3.1 and next-auth:4.20.1

[balazsorban44]

This endpoint is public, so it might simply be a bad actor trying. I would have a look at the logs to see where the requests are coming from.

Doesn't sound like a bug to me at first.

[simonecervini]

What do you mean by "bad actor"? In the logs I can personally confirm that the errors always come from requests made by real users to the endpoint /api/auth/callback/google?state=[...]&code=[...]&scope=[...]&authuser=0&prompt=none. I verified using Microsoft Clarity registrations as well, and they are all legit registration attempts.

If there is any way I can help please tell me, I understand that it is not the clearest discussion in the world and without accurate reproductions it is difficult to work

[simonecervini]

I usually observe that the first request succeeds and then a new request is made after several seconds and fails (the last one I looked at 14 seconds). In both I notice that searchParams has the same structure except for the code and prompt parameter (in the first case "consent" and in the second case "none"). So state does not change

[pmuens]

We're seeing the same error in our production logs. Do you know if users see an error if this happens? Or is this just a failing callback that doesn't affect the user experience.

Unfortunately I'm not able to reproduce this and test this myself...

We're on:

"next": "^13.5.4"
"next-auth": "^4.23.2"

[JW709]

Experiencing the same issue here.
Node v20.10.1
next-auth "^4.24.5"
next "13.4.7" <- the most recent supported version on firebase

at async NextAuth._args$ (/workspace/node_modules/next-auth/next/index.js:108:14) {
name: 'OAuthCallbackError',
code: undefined
},
providerId: 'facebook',
message: 'State cookie was missing.'
}

We get the same error for Google, Apple, and Facebook. All redirect URIs have been added.

const authOptions = { secret: process.env.NEXTAUTH_SECRET, // Configure one or more authentication providers providers: [ FacebookProvider({ clientId: process.env.FACEBOOK_CLIENT_ID ?? "", clientSecret: process.env.FACEBOOK_CLIENT_SECRET ?? "", }), AppleProvider({ clientId: process.env.APPLE_ID ?? "", clientSecret: process.env.APPLE_SECRET ?? "", }), GoogleProvider({ clientId: process.env.GOOGLE_CLIENT_ID ?? "", clientSecret: process.env.GOOGLE_CLIENT_SECRET ?? "", authorization: { params: { prompt: "consent", access_type: "offline", response_type: "code", }, }, }), ], jwt: { secret: process.env.NEXTAUTH_SECRET, }, cookies: { sessionToken: { name: __Secure-next-auth.session-token, options: { httpOnly: true, sameSite: "lax", path: "/", secure: true, }, }, callbackUrl: { name: __Secure-next-auth.callback-url, options: { sameSite: "lax", path: "/", secure: true, }, }, csrfToken: { name: __Host-next-auth.csrf-token, options: { httpOnly: true, sameSite: "lax", path: "/", secure: true, }, }, pkceCodeVerifier: { name: "next-auth.pkce.code_verifier", options: { httpOnly: true, sameSite: "lax", path: "/", secure: true, maxAge: 900, }, }, state: { name: "next-auth.state", options: { httpOnly: true, sameSite: "lax", path: "/", secure: true, maxAge: 900, }, }, nonce: { name: "next-auth.nonce", options: { httpOnly: true, sameSite: "lax", path: "/", secure: true, }, }, }, callbacks: { async redirect({ url, baseUrl }: any) { return baseUrl; }, async jwt({ token, account }: { token: any; account: any }) { if (account) { token.accessToken = account.access_token; token.provider = account.provider; } return token; }, async session({ session, token }: { session: any; token: any }) { session.accessToken = token.accessToken; session.provider = token.provider; return session; }, async signIn({ user, account }: { user: any; account: any }) { try { await registerUser({ displayName: user.name, email: user.email, region: "1", identityProvider: { id: account?.provider?.toUpperCase(), accessToken: account?.access_token, }, }); } catch (err: any) { console.warn(err); } return true; }, }, };

Here is my sample [...nextAuth] configuration. As a last ditch effort attempting to [manually specify cookies](https://next-auth.js.org/configuration/options#cookies) although this approach is not recommended.

[Gmust]

Had same problem with this on "next": "^13.4.5-canary.6", when I was using localhost it was Ok, after deploying it on vercel i recieve this error after login attemp
[next-auth][error][OAUTH_CALLBACK_ERROR] https://next-auth.js.org/errors#oauth_callback_error State cookie was missing. { error: TypeError: State cookie was missing. at Object.use (/var/task/node_modules/next-auth/core/lib/oauth/checks.js:103:23) at oAuthCallback (/var/task/node_modules/next-auth/core/lib/oauth/callback.js:89:25) at process.processTicksAndRejections (node:internal/process/task_queues:95:5) at async Object.callback (/var/task/node_modules/next-auth/core/routes/callback.js:52:11) at async AuthHandler (/var/task/node_modules/next-auth/core/index.js:208:28) at async NextAuthApiHandler (/var/task/node_modules/next-auth/next/index.js:22:19) at async NextAuth._args$ (/var/task/node_modules/next-auth/next/index.js:106:14) { name: 'OAuthCallbackError', code: undefined }, providerId: 'google', message: 'State cookie was missing.' }

[gavinthomas-valtech]

Having the same issue after upgrading to 1.20 from 1.15. Anyone from next auth understand whats changed between these versions?

[gertig]

One thing that can also cause this error is if your environment variable NEXTAUTH_URL is not set correctly. For example if you click the button that triggers Google oauth from a page at URL http://localhost:6060 then your .env (or similar) should include NEXTAUTH_URL=http://localhost:6060

[huychau-agilityio]

My steps:

1. Open Google accounts, the list must be greater than 1 account. Choose an account not registered, then redirect to my registration form.
2. Do nothing and click the back button on browser to back the list of accounts. Then choose the existing account. Got this error.
   Note: When I open Google accounts and choose the direct existing one, no problem.

[anshluu]

Any proper answer yet? still stuck here

[j3rryl]

Using 127.0.0.1 instead of localhost worked for me. PS: This issue only occurred during development cycle.

[tswymer]

Also facing the same issue with AzureADProvider in Edge

[sunil-psgl]

I am also having the same issue with any provider (github or google). Here are the code and logs

export const authOptions = {
  // Configure one or more authentication providers
  providers: [
    GithubProvider({
      clientId: process.env.GITHUB_ID,
      clientSecret: process.env.GITHUB_SECRET,
    }),
    GoogleProvider({
      clientId: process.env.GOOGLE_CLIENT_ID,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
      callbacks: {
        async signIn({ account, profile }) {
          console.log(account, profile);
          if (account.provider === 'google') {
            return (
              profile.email_verified && profile.email.endsWith('@psgltech.com')
            );
          }
          return true; // Do different verification for other providers that don't have `email_verified`
        },
      },
    }),
    // ...add more providers here
  ],
};
export default NextAuth(authOptions);

[next-auth][error][OAUTH_CALLBACK_ERROR] 
2023-11-25 15:32:26.800 NZDT
https://next-auth.js.org/errors#oauth_callback_error State cookie was missing. {
2023-11-25 15:32:26.800 NZDT
  error: TypeError: State cookie was missing.
2023-11-25 15:32:26.800 NZDT
      at Object.use (/workspace/node_modules/next-auth/core/lib/oauth/checks.js:111:23)
2023-11-25 15:32:26.800 NZDT
      at oAuthCallback (/workspace/node_modules/next-auth/core/lib/oauth/callback.js:89:25)
2023-11-25 15:32:26.800 NZDT
      at async Object.callback (/workspace/node_modules/next-auth/core/routes/callback.js:52:11)
2023-11-25 15:32:26.800 NZDT
      at async AuthHandler (/workspace/node_modules/next-auth/core/index.js:208:28)
2023-11-25 15:32:26.800 NZDT
      at async NextAuthApiHandler (/workspace/node_modules/next-auth/next/index.js:22:19)
2023-11-25 15:32:26.800 NZDT
      at async NextAuth._args$ (/workspace/node_modules/next-auth/next/index.js:108:14) {
2023-11-25 15:32:26.800 NZDT
    name: 'OAuthCallbackError',
2023-11-25 15:32:26.800 NZDT
    code: undefined
2023-11-25 15:32:26.800 NZDT
  },
2023-11-25 15:32:26.800 NZDT
  providerId: 'github',
2023-11-25 15:32:26.800 NZDT
  message: 'State cookie was missing.'
2023-11-25 15:32:26.800 NZDT
}

[jophuijbers-wf]

Same problem with KeycloakProvider. Only happens on Netlify server, works perfectly locally.

"next": "^13.4.1",
"next-auth": "^4.24.3",

[j3rryl]

Using 127.0.0.1 instead of localhost worked for me. PS: This issue only occurred during development cycle.

[coder054]

I get this error when the link expired, (I copy the link then re-using it). Just get the new link by calling signIn("azure-ad")

[yutounun]

I still struggle with this problem with GoogleProvider on staging environtment.
It doesn't happen on localhost but happens only after deploying with vercel.

[yutounun]

I figured out the problem. The reason was because I was writing "localhost" on the code.

How stupid I was... Thanks.

 callbacks: {
    async signIn({ user }) {
      const { name, email, id } = user;

      try {
        // Create new user
        const response = await fetch("http://localhost:3000/api/user", {

・・・

[YannHulot]

I can confirm that I see this error in production but it doesn't seem to affect the users.

I am on the latest nextjs version and latest next-auth version as well.

I am not sure if that is a big deal or not. I ll be watching this conversation to see if someone can come up with a reliable way to stop these errors from happening.

[b3ernardo]

It worked for me just adding checks: ['none']:

providers: [
        KeycloakProvider({
            checks: ['none'],
            clientId: `${process.env.FRONTEND_CLIENT_ID}`,
            clientSecret: `${process.env.FRONTEND_CLIENT_SECRET}`,
            issuer: `${process.env.AUTH_ISSUER}`
        })
]

[xdrtas]

I try all of the above but without any good result.
I'm working with the company oauth server, so I have to customize base on the parameters defined.
So, in the URL I must put the next: client_id, response_type, scope, nonce, state, redirect_uri, response_mode and prompt, so far so good..., login page loads correctly, I can login but when return to the localhost:3000 the error rise: State cookie was missing.

Any help would be appreciated

`import { randomUUID } from "crypto";
import NextAuth, { AuthOptions } from "next-auth";
import { OAuthConfig } from "next-auth/providers/oauth";

const myAuthoriry: OAuthConfig = {
id: 'backoffice',
name: 'backoffice',
issuer: 'https://myserver/authenticationserver',
clientId: 'backoffice',
type: 'oauth',
idToken: true,
clientSecret: 'secreto',
wellKnown: 'https://myserver/authenticationserver/.well-known/openid-configuration',
checks: ['state', 'nonce'],
authorization: {
params: {
client_id: 'backoffice',
response_type: 'code id_token',
scope: 'openid profile abi',
nonce: randomUUID(),
state: randomUUID(),
redirect_uri: 'http://localhost:3000/api/auth/callback/backoffice',
response_mode: 'form_post',
prompt: 'login'
}
},
userinfo: {
params: {
client_id: 'backoffice',
response_type: 'code id_token',
scope: 'openid profile abi',
nonce: randomUUID(),
state: randomUUID(),
}
},
token: {
params: {
client_id: 'backoffice',
response_type: 'code id_token',
scope: 'openid profile abi',
nonce: randomUUID(),
state: randomUUID(),
}
},
profile(profile) {
console.log(profile);
return ({
id: profile.id,
name: profile.name,
email: profile.email,
image: null,
})
},
};

const options: AuthOptions = {
providers: [elavon],
debug: false,
cookies: {
state: {
name: 'next-auth.state',
options: {
httpOnly: true,
sameSite: "Lax",
path: "/",
secure: false
}
}
},
callbacks: {
async signIn({ user, account, profile, email, credentials }) {
console.info('User: ', user);
const isAllowedToSignIn = true;

        if (isAllowedToSignIn) {
            window.location.href = 'http://localhost:3000/loadbackoffice';
            return true;
        } else {
            return false;
        }
    },
    async session({ session, user }) {
        console.info('Session: ', session);
        session.user.id = user.id;
        return session;
    },
    async redirect({ url, baseUrl }) {
        const redirectUrl = url.startsWith('/') ? new URL(url, baseUrl).toString() : url;

        return redirectUrl;
    }
}

}

const handler = NextAuth(options);

export { handler as GET, handler as POST };`

[jpsaturnino]

For me the problem was solved redirecting for the right domain, so in my case:

NEXTAUTH_URL = temp-domain.com -> domain.com

I was trying to log in to the LinkedIn provider via domain.com, when in fact the nextauth environment was set to temp-domain.com

[PVUL]

I had this error running locally and what helped me resolve my issue was to set the correct callback URL http://app.localhost:3000/api/auth/callback/github and env var NEXTAUTH_URL="http://app.localhost:3000".

These are referenced in the docs:

• https://vercel.com/guides/nextjs-multi-tenant-application#4.-update-your-nextauth.js-callback-urls
• https://vercel.com/guides/nextjs-multi-tenant-application#2.-set-up-environment-variables

[tcb1978]

"next": "14.0.4",
"next-auth": "^4.24.5",


Exact same problem with Okta when running with Cypress Test Runner. Work in local just fine manually. Error only appears when running with Cypress.

[AliakseiPaseishviliSyntheticabio]

Hi everyone, hope my answer will help to everyone. We work with Keycloak.

Our config looks like this:

import dayjs from 'dayjs';
import { jwtDecode } from 'jwt-decode';
import { AuthOptions } from 'next-auth';
import { JWT } from 'next-auth/jwt';
import KeycloakProvider from 'next-auth/providers/keycloak';

declare module 'next-auth/jwt' {
  interface JWT {
    access_token: string;
    id_token: string;
    expires_at: number;
    refresh_token: string;
    error?: string;
    roles: string[];
  }
}

declare module 'jwt-decode' {
  export interface JwtPayload {
    realm_access: { roles: string[] };
  }
}

declare module 'next-auth' {
  interface Session {
    error?: string;
    roles: string[];
    sub?: string;
  }
}

const COOKIES_LIFE_TIME = 24 * 60 * 60;
const COOKIE_PREFIX = process.env.NODE_ENV === 'production' ? '__Secure-' : '';

const refreshAccessToken = async (token: JWT) => {
  const url = `${process.env.KEYCLOACK_ISSUER}/protocol/openid-connect/token`;
  const resp = await fetch(url, {
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      client_id: process.env.KEYCLOACK_CLIENT_ID,
      client_secret: process.env.KEYCLOACK_CLIENT_SECRET,
      grant_type: 'refresh_token',
      refresh_token: token.refresh_token,
    }),
    method: 'POST',
  });
  const refreshToken = await resp.json();
  if (!resp.ok) throw refreshToken;

  const tokenData = jwtDecode(refreshToken.access_token);

  return {
    ...token,
    access_token: refreshToken.access_token,
    id_token: refreshToken.id_token,
    expires_at: Math.floor(Date.now() / 1000) + refreshToken.expires_in,
    refresh_token: refreshToken.refresh_token,
    roles: tokenData.realm_access.roles,
  };
};

export const authOptions: AuthOptions = {
  providers: [
    KeycloakProvider({
      clientId: process.env.KEYCLOACK_CLIENT_ID,
      clientSecret: process.env.KEYCLOACK_CLIENT_SECRET,
      issuer: process.env.KEYCLOACK_ISSUER,
    }),
  ],
  callbacks: {
    async jwt({ token, account, trigger }) {
      const nowTimeStamp = dayjs();

      try {
        // we refresh token on update action
        if (trigger === 'update') {
          return await refreshAccessToken(token);
        }

        // we get intial token on sign in
        if (
          account &&
          account.access_token &&
          account.id_token &&
          account.expires_at &&
          account.refresh_token
        ) {
          const tokenData = jwtDecode(account.access_token);

          token.roles = tokenData.realm_access.roles;
          token.access_token = account.access_token;
          token.id_token = account.id_token;
          token.expires_at = account.expires_at;
          token.refresh_token = account.refresh_token;
          return token;
          // if time of expires is more then current date then we return existing token.
        } else if (
          token &&
          nowTimeStamp.isBefore(dayjs.unix(token.expires_at))
        ) {
          return token;
          // this happens after user session is expired, so in this case we try to update user session
        } else {
          return await refreshAccessToken(token);
        }
        // if session update is failed we return error and on client we are doing logout(TokenExpireController).
      } catch (error) {
        return { ...token, error: 'RefreshAccessTokenError' };
      }
    },
    async session({ session, token }) {
      session.error = token.error;
      session.roles = token.roles;
      session.sub = token.sub;

      return session;
    },
  },
  events: {
    async signOut({ token }) {
      const logOutUrl = new URL(
        `${process.env.KEYCLOACK_ISSUER}/protocol/openid-connect/logout`,
      );
      logOutUrl.searchParams.set('id_token_hint', token.id_token!);

      await fetch(logOutUrl);
    },
  },
  secret: process.env.NEXTAUTH_SECRET,
  pages: {
    signIn: '/auth/signin',
  },
  cookies: {
    sessionToken: {
      name: `${COOKIE_PREFIX}next-auth.session-token`,
      options: {
        httpOnly: true,
        sameSite: 'lax',
        path: '/',
        secure: true,
      },
    },
    callbackUrl: {
      name: `${COOKIE_PREFIX}next-auth.callback-url`,
      options: {
        sameSite: 'lax',
        path: '/',
        secure: true,
      },
    },
    csrfToken: {
      name: `${COOKIE_PREFIX}next-auth.csrf-token`,
      options: {
        httpOnly: true,
        sameSite: 'lax',
        path: '/',
        secure: true,
      },
    },
    pkceCodeVerifier: {
      name: `${COOKIE_PREFIX}next-auth.pkce.code_verifier`,
      options: {
        httpOnly: true,
        sameSite: 'lax',
        path: '/',
        secure: true,
        maxAge: COOKIES_LIFE_TIME,
      },
    },
    state: {
      name: `${COOKIE_PREFIX}next-auth.state`,
      options: {
        httpOnly: true,
        sameSite: 'lax',
        path: '/',
        secure: true,
        maxAge: COOKIES_LIFE_TIME,
      },
    },
    nonce: {
      name: `${COOKIE_PREFIX}next-auth.nonce`,
      options: {
        httpOnly: true,
        sameSite: 'lax',
        path: '/',
        secure: true,
      },
    },
  },
};

So why I added cookies to config?
I figured out that main 2 cookies pkceCodeVerifier and state live only 15 minutes, which creates bug.
For example user can do login via keycloak for 30 minutes, and if user just waits for 15 minutes and more, then after successful login in keycloak with redirect we got State cookie was missing, which actually shows wierd signin page from nextauth.
Changing time to 1 day totally fix the issue.

In this case we do not need to turn off 'checks' in config.
From other point in documentation said that rewriting cookies is not good, but this is only the way to fix our issue.

We also do redirect from nextauth signin page to our custom signin page with nice design.

[arielff3]

Nice job!

[maiconcarraro]

just curious, how do you use the trigger param for jwt function? how does it "trigger the trigger"?

[AliakseiPaseishviliSyntheticabio]

@maiconcarraro in docs described when you can use 'trigger'.
We have logic, where we refresh user session in client app. It is method update of useSession hook. It is said that you trigger update of JWT, but as it is keycloak - you need to write this logic on your own in config.

[maiconcarraro]

gotcha, thank you, missed this

[arisonx]

To me, fixing the DNS addresses of the network solved the issue. I was using the following: 1.1.1.1, 8.8.4.4. After hours of trying to resolve it, I decided to change the DNS to: 8.8.8.8 and 8.8.4.4, and finally it worked. Maybe because I was using Cloudflare and Google as DNS.

[artem-simutin]

I just found that this issue happens when I use turbopack (next dev --turbo command) using next 14.1.3. Using regular next dev works without any issues.