next-auth not working with latest Next.js v12.2.0 Middleware update

[larsqa]

Environment

System:
OS: macOS 12.3.1
CPU: (10) arm64 Apple M1 Pro
Memory: 99.58 MB / 16.00 GB
Shell: 5.8 - /bin/zsh
Binaries:
Node: 16.15.0 - /usr/local/bin/node
npm: 8.5.5 - /usr/local/bin/npm
Browsers:
Chrome: 103.0.5060.114
Firefox: 102.0.1
Safari: 15.4
npmPackages:
next: ^12.2.2 => 12.2.2
next-auth: ^4.3.4 => 4.5.0
react: 18.0.0 => 18.0.0

Reproduction URL

N/A

Describe the issue

Next.js introduced breaking changes in their latest v12.2 version (upgrade guide: https://nextjs.org/docs/messages/middleware-upgrade-guide).
Basically, there should only be a root middleware, and not nested ones with _ prepended names.

The new root middleware has a following syntax:

export async function middleware(req) {
    if (req.nextUrl.pathname.startsWith("/api/v1/protected")) {
        const token = await getToken({ req });

        if (token) {
            // Authenticated user - allow access

            return NextResponse.next();
        }

        return NextResponse.redirect(new URL("/api/unauthenticated", req.url));
    }


    // Else just pass through
    return NextResponse.next();
}

Here, the req seems to be different from what we know from API routes req

export default function handler(req, res) {
  res.status(200).json({ name: 'John Doe' })
}

or the old _middleware.js files.

Passing the req from the root middleware to getToken({req}) returns null even if we specify the secret getToken({req, secret}) //->null.

How to reproduce

• Update to next v12.2 or later
• Add a root middleware
• Try to get the token (getToken()) using the middleware's req parameter. This step fails.

Expected behavior

getToken() should be useable in a root middleware, since this is how next v12.2 works now.

[balazsorban44]

Hi, this should work as you can see here

https://next-auth-example.vercel.app/

Source code https://github.com/nextauthjs/next-auth/blob/main/apps/example-nextjs/middleware.ts

make sure you are on next-auth@latest

[larsqa]

@balazsorban44 my bad - you're right. After updating to 4.9.0 this issue has been resolved.
Stupid me - thought about everything except updating next-auth.... :P

Thanks!