From 636ef1e1e4ad484daf8978eaf00368baacc5faf5 Mon Sep 17 00:00:00 2001 From: BeilunYang <786220806@qq.com> Date: Sat, 29 Aug 2026 18:12:16 +0800 Subject: [PATCH] fix(auth): declare GitHub's issuer so RFC 9207 iss validation passes (#139) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub now returns an RFC 9207 `iss` parameter on the OAuth callback (`iss=https://github.com/login/oauth`). oauth4webapi validates it against `as.issuer`, and @auth/core fills that with the placeholder "https://authjs.dev" for non-OIDC providers, so every GitHub sign-in dies with CallbackRouteError — which the error page reports to users as /api/auth/error?error=Configuration ("There is a problem with the server configuration"), even though nothing in the config is actually wrong. Declaring the real issuer makes the comparison pass. Safe to set: the provider already defines token/userinfo URLs, so this does not switch @auth/core onto the OIDC discovery path. Google is unaffected because it discovers its issuer from OIDC metadata. Affects every deployment on next-auth 5.0.0-beta.25 (@auth/core 0.37.2, oauth4webapi 3.1.4). GitHub first shipped this April 6-10 2026, put it on hold on April 15 after it broke next-auth, then re-enabled it around 2026-08-19 with no announcement. Co-authored-by: Claude Opus 5 (1M context) --- app/lib/auth.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/app/lib/auth.ts b/app/lib/auth.ts index 916d09f..783d718 100644 --- a/app/lib/auth.ts +++ b/app/lib/auth.ts @@ -104,6 +104,7 @@ export const { clientId: process.env.AUTH_GITHUB_ID, clientSecret: process.env.AUTH_GITHUB_SECRET, allowDangerousEmailAccountLinking: true, + issuer: "https://github.com/login/oauth", }), Google({ clientId: process.env.AUTH_GOOGLE_ID,