fix(auth): update better-auth baseURL to use HTTPS in production #238
Conversation
👷 Deploy request for appcut pending review.Visit the deploys page to approve it
|
|
@nielchaudhary is attempting to deploy a commit to the Maze Winther's projects Team on Vercel. A member of the Team first needs to authorize it. |
WalkthroughThe authentication client and server configuration were updated to explicitly handle different environments. The client now sets its base URL based on whether the environment is production or not, and the server adds "https://opencut.app" as a trusted origin in addition to "http://localhost:3000". Changes
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
packages/auth/src/client.ts (1)
4-8: LGTM! Consider environment variables for better deployment flexibility.The conditional logic correctly addresses the mixed content error by using HTTPS in production. However, consider using environment variables instead of hardcoded URLs for better deployment flexibility:
- baseURL: - process.env.NODE_ENV === "production" - ? "https://opencut.app" - : "http://localhost:3000", + baseURL: process.env.NEXT_PUBLIC_BETTER_AUTH_URL || + (process.env.NODE_ENV === "production" + ? "https://opencut.app" + : "http://localhost:3000"),This approach allows environment variable override while maintaining the hardcoded fallbacks.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
packages/auth/src/client.ts(1 hunks)packages/auth/src/server.ts(1 hunks)
🔇 Additional comments (1)
packages/auth/src/server.ts (1)
26-26: LGTM! Correct fix for mixed content error.Adding "https://opencut.app" to trustedOrigins ensures the auth server accepts requests from the production HTTPS client, while maintaining localhost support for development.
|
@mazeincoding the get-session API call is failing on production due to |
1 participant
Bug Report
Platform
Browser
Current Behavior
The application is experiencing a mixed content error when trying to authenticate users on the production site. The browser blocks authentication requests because:
https://opencut.app/)NEXT_PUBLIC_BETTER_AUTH_URLenvironment variable is set tohttp://opencut.app(HTTP)http://opencut.app/api/auth/get-session, the browser blocks it with the error:This results in authentication features (sign in, sign up, session management) being completely broken in production, while working fine in local development.
Here's a suggested description for the "Expected Behavior" section:
Expected Behavior
Authentication should work seamlessly in production without any mixed content errors. Specifically:
https://opencut.app/api/auth/*endpoints when running in productionThe auth baseURL should automatically use the appropriate protocol (HTTP for localhost, HTTPS for production) to ensure secure communication while maintaining functionality across all environments.
Recurrence Probability
Steps to Reproduce
https://opencut.app/get-sessioncall in the Network tab shows a request tohttp://opencut.app/api/auth/get-session(HTTP instead of HTTPS)Expected network request:
https://opencut.app/api/auth/get-sessionActual network request:
http://opencut.app/api/auth/get-session(blocked by browser)Screenshots
Testing Notes
Environment
Summary by CodeRabbit