How to Fix NO_SECRET warning thrown by Next-Auth

Question

I have a Next js application that uses Next Auth. While in development I continuously keep getting that warning stipulating that I need to set a secret but I don't know where I should set it.

Following this reference I see I just need to run openssl rand -base64 32 to get a secret but I have no Idea where to put it

score 18 · Accepted Answer · answered Jan 14 '22 at 17:22

18

In the [...nextauth].js outside provider and callback you can set the secret and it's value. As it is recommended to store such values in environment variable you can do the following

export default NextAuth({
 
  providers: [ 
  ],
  callbacks: {
  },
  secret: process.env.JWT_SECRET,
});

answered Jan 14 '22 at 17:22

Laspeed

791
1
5
27

This is working with only one provider, what if there are more than one provider? – Usama Abdul Razzaq Jun 23 '22 at 05:22

score 12 · Answer 2 · answered Apr 05 '22 at 14:02

You should insert the command openssl rand -base64 32in your Linux terminal, then it will generate a Token to use it on an .env file with the variable name NEXTAUTH_SECRET=token_generated. So the error [next-auth][warn][NO_SECRET] will not be showed again on console.

score 7 · Answer 3 · answered Jun 13 '22 at 09:52

7

In my case i had to upgrade next and next-auth module to the latest version. next@12.1.6 and next-auth@4.5.0 worked for me.

NEXTAUTH_SECRET=secret string here

You can generate secret key using this command line openssl rand -base64 32 in command prompt or windows power shell.

And in the next-auth configuration [...nextauth].ts file

export default NextAuth({
 
  providers: [ 
  ],
  callbacks: {
  },
  secret: process.env.NEXTAUTH_SECRET,
});

It is said if secret is not defined in [...nextauth].ts, it loads NEXTAUTH_SECRET from env, but I added it and works like charm. :)

answered Jun 13 '22 at 09:52

Baymax

479
4
7

The command you said neither works in CMD nor PS. – Ali Bahaari Jul 01 '23 at 08:53
1

link to possible solution @AliBahaari https://stackoverflow.com/questions/11896304/openssl-is-not-recognized-as-an-internal-or-external-command – Baymax Jul 08 '23 at 00:14

score 0 · Answer 4 · edited Aug 22 '23 at 02:49

I had this problem recently on a Vercel deployment

I solved it with the following steps:

Create NEXTAUTH_URL and NEXTAUTH_SECRET on .env (the URL is your domain and the secret is any hash)
Go on your settings project on Vercel and add NEXTAUTH_SECRET on your Environment Variables (same secret of your .env)

I'm using middleware and the code is:

export { default } from "next-auth/middleware"
export const config = { matcher: ["/admin/dashboard/", "/admin/dashboard/:path*"] }

How to Fix NO_SECRET warning thrown by Next-Auth

4 Answers4