with-middleware-auth-required and basePath

[ZacharySchaffter]

Checklist

• The issue can be reproduced in the nextjs-auth0 sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

There was an original bug reported here in #1062 that with-middleware-auth-required doesn't prepend the basePath. The solution was to append a static returnUrl.

We would like users to be redirected to the page they had tried to access prior to being redirected, which limits our ability to use the static returnTo solution.

This is causing issues for our setup similar to that original issue — our app serves distinct nextjs apps at different paths (e.g. app1 is served from domain.com/app1, and app2 is served from domain.com/app2). This means that redirects from nextjs-auth0 are redirecting users to a different application following successful login.

Expectation

Users should be redirected back to the original URL they were redirected from.

Possible Solution

The NextRequest.nextUrl property provides a basePath variable that seems to be set to the initial route paramer. Appending it to the NextResponse.redirect() url appears to fix this issue.

const { pathname, origin, search, basePath } = req.nextUrl;
{...}
new URL(`${login}?returnTo=${encodeURIComponent(`${basePath}${pathname}${search}`)}`, origin)

Are there any known reasons the NextRequest.nextUrl.basePath value shouldn't/couldn't be used here?

Reproduction

• Set a basePath in the next.config
• Update api paths in nav.tsx, layout.tsx, and env to include the basepath
• Run app
• Access the profile-middleware route to be redirected to universal login
• Authenticate via universal login
• Verify you're redirected back to the original URL, but with the base path omitted.

Additional context

nextjs-auth0 version

3.0.0

Next.js version

13.4.10

Node.js version

18.16.0

[adamjmcgrath]

Hi @ZacharySchaffter - thanks for raising this

Are there any known reasons the NextRequest.nextUrl.basePath value shouldn't/couldn't be used here?

I can't think of one - will leave this open as an enhancement

[adamjmcgrath]

Hi @ZacharySchaffter

I've merged #1342 which should resolve your issue, once it's been released you can do:

withMiddlewareAuthRequired({ returnTo: ({ nextURL }) => `${nextURL.basePath}${nextURL.pathname}${nextURL.search}`});

I couldn't change the behaviour of the method itself in a minor release because it might break users that have worked around this limitation in the past (by customizing the login or callback handlers)

I'll publish the minor release later this week