v3.14.0 bug: TypeError: [provider.protection].flat is not a function

[liamross]

Describe the bug

provider.protection is not a required property, and not providing it breaks the package since .flat() is called without first verifying it is an array.

Steps to reproduce

Add a custom provider without specifying protection property

Additional context

Here are all the places this is done:
https://github.com/nextauthjs/next-auth/search?q=%5Bprovider.protection%5D.flat%28%29

[balazsorban44]

thanks, I think you are right! A PR is very welcome for this as it should be an easy fix, but if no one volunteers, I'll just do it myself. 🙂

[liamross]

@balazsorban44 I can, but what about this case where provider.protection is assigned a string?

next-auth/src/server/index.js

Line 79 in dbe283f

provider.protection = 'state' // Default to state, as we did in 3.1 REVIEW: should we use "pkce" or "none" as default?

Should that be an array? The documentation is not super clear on what types provider.protection is allowed to be.

[balazsorban44]

Originally it was supposed to be a string, but later I was told it would be great if it did support different methods of protection, like PKCE AND state for example (there is also nonce, which isn't implemented right now). For that not to be a breaking change, we still support both a string and an array of strings.

I guess it would be nice if in the core, we just used an array everywhere, so changing that line to ["state"] would be fine.

[fxamauri]

A provisional solution until we wait for the pull request, use node 11 or higher for Array.prototype.flat to be available 😜

[fxamauri]

see if this can be fixed in this version #1684

[github-actions]

🎉 This issue has been resolved in version 3.14.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This issue has been resolved in version 3.14.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This issue has been resolved in version 4.0.0-next.5 🎉

The release is available on:

• npm package (@next dist-tag)
• GitHub release

Your semantic-release bot 📦🚀