Corporate proxy

Using Auth.js behind a corporate proxy is not supported out of the box. This is due to the fact that the underlying library we use, openid-client which uses the built-in Node.js http / https libraries, and those do not support proxies by default:

• http docs
• https docs

Therefore, we'll need to add an additional proxy agent to the http client, such as https-proxy-agent.

info

openid-client allows the user to set an agent for requests (source).

Thanks to raphaelpc for the below diff, which when applied to v4.2.1, adds this agent support to the client.js file.

diff --git a/node_modules/next-auth/core/lib/oauth/client.js b/node_modules/next-auth/core/lib/oauth/client.js
index 77161bd..1082fba 100644
--- a/node_modules/next-auth/core/lib/oauth/client.js
+++ b/node_modules/next-auth/core/lib/oauth/client.js
@@ -7,11 +7,19 @@ exports.openidClient = openidClient;

 var _openidClient = require("openid-client");

+import { HttpsProxyAgent } from 'https-proxy-agent';
+
 async function openidClient(options) {
   const provider = options.provider;
-  if (provider.httpOptions) _openidClient.custom.setHttpOptionsDefaults(provider.httpOptions);
-  let issuer;
+  let httpOptions = {};
+  if (provider.httpOptions) httpOptions = { ...provider.httpOptions };
+  if (process.env.http_proxy) {
+    let agent = new HttpsProxyAgent(process.env.http_proxy);
+    httpOptions.agent = agent;
+  }
+  _openidClient.custom.setHttpOptionsDefaults(httpOptions);

+  let issuer;
   if (provider.wellKnown) {
     issuer = await _openidClient.Issuer.discover(provider.wellKnown);
   } else {

For more details, see this issue

After applying this patch, we can add then add the proxy connecting string via the http_proxy environment variable.

OAuth Provider Issue

If you're having trouble with your OAuth provider when using the https-proxy-agent, you may be using a provider which requires an extra request to, for example, fetch the users profile picture. In cases like these, you'll have to add the proxy workaround to your provider config as well. Below is an example of how to do that for the AzureAD provider, but it should work with any other provider:

diff --git a/node_modules/next-auth/providers/azure-ad.js b/node_modules/next-auth/providers/azure-ad.js
index 73d96d3..536cd81 100644
--- a/node_modules/next-auth/providers/azure-ad.js
+++ b/node_modules/next-auth/providers/azure-ad.js
@@ -5,6 +5,8 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.default = AzureAD;

+const HttpsProxyAgent = require('https-proxy-agent');
+
 function AzureAD(options) {
   var _options$tenantId, _options$profilePhoto;

@@ -22,11 +24,15 @@ function AzureAD(options) {
     },

     async profile(profile, tokens) {
-      const profilePicture = await fetch(`https://graph.microsoft.com/v1.0/me/photos/${profilePhotoSize}x${profilePhotoSize}/$value`, {
+      let fetchOptions = {
         headers: {
-          Authorization: `Bearer ${tokens.access_token}`
-        }
-      });
+          Authorization: `Bearer ${tokens.access_token}`,
+        },
+      };
+      if (process.env.http_proxy) {
+        fetchOptions.agent = new HttpsProxyAgent(process.env.http_proxy);
+      }
+      const profilePicture = await fetch(`https://graph.microsoft.com/v1.0/me/photos/${profilePhotoSize}x${profilePhotoSize}/$value`, fetchOptions);

       if (profilePicture.ok) {
         const pictureBuffer = await profilePicture.arrayBuffer();