Environment

  System:
    OS: macOS 13.1
    CPU: (8) arm64 Apple M1 Pro
    Memory: 285.25 MB / 16.00 GB
    Shell: 5.8.1 - /bin/zsh
  Binaries:
    Node: 18.14.0 - ~/.n/bin/node
    Yarn: 1.22.19 - /opt/homebrew/bin/yarn
    npm: 9.3.1 - ~/.n/bin/npm
    Watchman: 2023.02.06.00 - /opt/homebrew/bin/watchman
  Browsers:
    Chrome: 110.0.5481.100
    Safari: 16.2

Reproduction URL

https://vercel.com

Describe the issue

I'm deploying nextjs app with nextauth to Vercel, and NEXTAUTH_URL gets overwritten. Usually, it wouldn't be a problem: according to the code I was able to find, next-auth gets the host value from the Vercel's system env variables, uses it, and everything works.

However... 👇

How to reproduce

In my case, I'm using zones i.e. proxies, to host one application (the landing) from /, and another application (the actual app with auth) from /app. And in this case, Vercel injects through its env variables not the host user requested, but rather the host the app is deployed at.

And it breaks the whole set up.

I was able to fix the issue locally, by using patch-package, here's the patch:

diff --git a/node_modules/next-auth/.DS_Store b/node_modules/next-auth/.DS_Store
new file mode 100644
index 0000000..e69de29
diff --git a/node_modules/next-auth/utils/detect-host.js b/node_modules/next-auth/utils/detect-host.js
index 59f70f4..c6351d4 100644
--- a/node_modules/next-auth/utils/detect-host.js
+++ b/node_modules/next-auth/utils/detect-host.js
@@ -8,6 +8,10 @@ exports.detectHost = detectHost;
 function detectHost(forwardedHost) {
   var _process$env$VERCEL;
 
-  if ((_process$env$VERCEL = process.env.VERCEL) !== null && _process$env$VERCEL !== void 0 ? _process$env$VERCEL : process.env.AUTH_TRUST_HOST) return forwardedHost;
+  if (!process.env.NEXTAUTH_URL) {
+    if ((_process$env$VERCEL = process.env.VERCEL) !== null && _process$env$VERCEL !== void 0 ? _process$env$VERCEL : process.env.AUTH_TRUST_HOST) {
+      return forwardedHost;
+    }
+  }
   return process.env.NEXTAUTH_URL;
 }
\ No newline at end of file

As you see, I'm adding a condition that prevents the host from being overwritten if the NEXTAUTH_URL was set by the user.

Expected behavior

I expect next-auth to not overwrite the host with value provided by Vercel (or whomever else), when NEXTAUTH_URL is explicitly set by the user.