next-auth npm package: is it safe?

The CSRF token hash is computed by concatenating the token and options.secret directly without a delimiter. If the secret can be controlled or guessed, this could allow token forgery. However, the token is 32 random bytes, making brute force infeasible.

The signinPageUrl is constructed by concatenating url with '/signin'. If url is not properly validated, this could allow open redirect or link manipulation. However, url is expected to be a URL object from the framework, reducing risk.

User-controlled values (theme.brandColor, theme.buttonText) are set via document.documentElement.style.setProperty and injected into style tags. This may allow CSS injection attacks such as UI redressing or style-based exfiltration.

The component renders url.origin and url.host directly into an anchor href. If the url prop is derived from untrusted input (e.g., request query parameters), this can be abused for phishing or open redirect attacks, though Preact escaping limits direct XSS here.

The function FACEIT is exported and called when the provider is instantiated. The Authorization header is built using Buffer.from with options.clientId and options.clientSecret at the time the function is invoked. This is normal for OAuth configuration and does not execute at module import time by itself.

The code constructs a Basic Authorization header by base64-encoding the clientId and clientSecret. While this is standard OAuth practice, the credentials are embedded directly into a header object at provider initialization. This is expected behavior for OAuth providers, but it means the client secret is present in memory and potentially in logs if headers are logged.

The OAuth access token is appended as a query parameter (oauth_token) to the Foursquare API URL. Query parameters may be logged by servers, proxies, or CDNs, exposing the token. This is a security best practice violation, though it matches Foursquare's documented OAuth 2.0 flow.

The HTTP request only races 'response' and 'timeout' events. Network errors (e.g., DNS failure, connection refused) emit an 'error' event that is not handled, which can cause an unhandled 'error' event and crash the process.

The authorization endpoint requests the 'identity' scope (typically mapped to account identity access). While 'identity' is a common scope for user profile retrieval, the static embedding of scope in the authorization URL is standard for this provider type. No exfiltration, credential harvesting, or suspicious behavior is present. Noted as a minor observation for transparency only.

The token endpoint URL contains a leading space (' https://www.reddit.com/api/v1/access_token'), which is likely a copy-paste error. While not inherently malicious, it could cause runtime failures or unexpected behavior in URL parsing, and may indicate insufficient code review. Legitimate OAuth provider definitions should use a clean, properly formatted URL.

The code performs an HTTPS request to the official Trakt API endpoint (api.trakt.tv) for user info, using OAuth tokens and API key passed in headers. This is expected OAuth behavior and not data exfiltration.

Uses context.tokens.access_token and context.provider.clientId for authentication with the Trakt API. These are standard OAuth credentials, not harvested from sensitive files or environment variables.

The code reads process.env.NEXTAUTH_URL, process.env.VERCEL_URL, and process.env.NEXTAUTH_URL_INTERNAL to construct authentication URLs. While these are standard NextAuth configuration variables, accessing environment variables at module load time could expose sensitive configuration if these values are inadvertently logged or transmitted.

The code uses BroadcastChannel to synchronize session state across browser tabs. While not inherently malicious, it can be used to propagate session data between tabs, which might be concerning if origin checks are not properly enforced.

In signIn and signOut functions, window.location.href is set to a URL derived from server response (data.url) or callbackUrl parameter. If an attacker can influence callbackUrl or the server response, this could lead to open redirect vulnerabilities. However, this is expected behavior for authentication libraries.

fetchData constructs a URL from a caller-supplied base URL and forwards the incoming request's cookie header to it. This is standard behavior for NextAuth clients to propagate session cookies to its own backend, but if baseUrl/baseUrlServer is attacker-influenced, cookies could be sent to an unintended host. In normal usage these values come from trusted configuration, so this is informational rather than malicious.

BroadcastChannel.receive parses event.newValue JSON without deep validation. A malformed or malicious localStorage entry for the channel name could cause JSON.parse to throw inside the storage event handler; the try/catch absence there is a robustness concern, not a code-execution or exfiltration issue.

In the '_log' POST action, the logger level is taken from req.body.level and used as a property lookup on the logger object: logger[level](code, metadata). While the logger object itself is controlled by the library author and set via setLogger, an attacker could pass arbitrary level values from the request. In the typical pino-based logger implementation this would just fail or no-op for invalid levels, but if a custom logger with unexpected properties/methods were used, this could invoke unintended functions. This is a minor robustness concern rather than a clear malicious pattern.

detectOrigin uses client-supplied x-forwarded-host and x-forwarded-proto headers to compute the origin used for redirects and callback URL construction. If a deployment trusts these headers from untrusted clients, it can enable host-header injection / open redirect issues. This is standard NextAuth behavior and a known configuration concern, not a malicious pattern.

The function validates that account.providerAccountId and account.type exist and that account.type is either 'email' or 'oauth'. This is good practice and limits unexpected inputs.

The unhashed verification token is included in the email callback URL, which could leak via logs, referrers, or browser history. This is a standard part of the email sign-in flow (the token is hashed before DB storage), but proper handling (short expiry, single use, HTTPS) is required.

No explicit redaction or sanitization of token before embedding in URL/query string; if the URL is logged or captured by analytics, the token could be exposed.

The module exports a module-level mutable Map (oAuth1TokenStore). This is not malicious but could be a source of cross-request state leakage or memory growth if not managed carefully by callers.

custom.setHttpOptionsDefaults(provider.httpOptions) mutates global state of the openid-client library, which could affect other clients using the same library instance. This is a design concern rather than a malicious pattern.

The code uses provider.wellKnown for issuer discovery via Issuer.discover(), and constructs Issuer with endpoints from options.provider. If these values are attacker-controlled, they could redirect OAuth flows to malicious servers. However, this is expected OAuth client configuration behavior and the values come from internal options, not external input.

The file only uses Node.js crypto.createHash for hashing and does not perform any network requests, file system access outside package scope, process spawning, dynamic code execution, environment variable harvesting, or obfuscated behavior. The code appears to be part of an authentication library (likely NextAuth.js) and is functionally benign.

hashToken concatenates the token directly with the provider secret (or default secret) before SHA-256 hashing without any delimiter or HMAC construction. While not directly malicious, this pattern can be vulnerable to length-extension or ambiguity issues depending on usage. More importantly, it demonstrates that secrets are embedded in hash inputs, which could be exposed if the code is misused or if hash outputs are logged.

The signinPageUrl is constructed by concatenating url (an InternalUrl type) with '/signin' and used as the href of anchor tags. If url is derived from untrusted input, this could enable open redirect or phishing attacks.

theme.logo is used directly as the src attribute of an <img> tag without validation. A malicious theme could cause the browser to load an external image, potentially leaking referrer information or enabling tracking.

The callbackUrl parameter is passed directly into a hidden form field without validation. While this is typical for OAuth flows, if the callbackUrl is not validated server-side, it could lead to open redirect vulnerabilities. Similarly, csrfToken is exposed in the form, but this is expected behavior for CSRF protection.

theme.logo is used directly as an <img> src attribute without validation. A malicious or external URL could be used for tracking, data exfiltration via referrer headers, or UI redressing. Low severity as it is a standard pattern for theme customization.

The url.origin value is used directly as an href attribute. If the InternalUrl object is derived from user-supplied or request-controlled input without validation, this could lead to an open redirect or phishing link. However, based on the interface name (InternalUrl) and typical usage in NextAuth-style code, this is likely trusted internal data.

The path is computed at module load time (top-level), meaning the path resolution and potential file read behavior is determined at import time. This is not malicious per se, but it is a pattern that executes at import.

The code uses process.env.NODE_ENV to determine which file path to read. This is a standard pattern and not inherently malicious, but it does rely on environment variables for control flow.

The code makes standard GitHub OAuth API calls to fetch user profile and email data, which is expected for an OAuth provider implementation.

The access token is placed in the URL path when fetching the user profile, which is a common OAuth pattern for this provider but could expose the token in logs or referrer headers. This is not malicious.

The token endpoint URL contains a leading space (' https://www.reddit.com/api/v1/access_token'). In OAuth flows, a malformed URL like this could cause errors or potentially be exploited if not trimmed, though it is more likely a typo. It is unusual and could indicate tampering or a mistake.

The profile function returns null for name and email and uses profile.user_id as id without validation. While not directly malicious, returning null for required fields could lead to unexpected behavior in downstream applications.

formatError mutates the input error object by assigning o.error and o.message. This side-effect could cause unexpected behavior in the caller's error object, including leaking sensitive properties that are later serialized.

proxyLogger sends client-side log messages (including error metadata) to a server endpoint /_log via sendBeacon or fetch. While this is intended for error reporting to the application's own backend (basePath), it still constitutes data leaving the client and could leak sensitive information present in error metadata if not properly sanitized. The endpoint is constructed from a user-supplied basePath, which could be tampered with to redirect logs to an attacker-controlled server.