Call to /api/auth/session gives ECONNRESET - next-auth - node.js

Question

I'm relatively new to next-auth & next in general. We have an application which we are transitioning to using AWS Cognito for authentication. It's a server side rendered application & I know this as under pages/_app.tsx is getInitialProps(). The code being:
import React from "react";
import App from "next/app";
import Router from "next/router";
import { Provider } from "react-redux";
import withRedux from "next-redux-wrapper";
import ReduxToastr from "react-redux-toastr";
import NProgress from "nprogress";
import * as Sentry from "#sentry/node";
// import { setTokens } from "../util/tokens";
import jwtDecode from "jwt-decode";
import { SessionProvider, getSession } from "next-auth/react";
import createStore from "../redux/store";
import { setSession } from "../redux/session";
import "semantic-ui-css/semantic.min.css";
import "react-redux-toastr/lib/css/react-redux-toastr.min.css";
import "../styles/nprogress.css";
import "../styles/overrides.scss";
import "../styles/util.css";
import axios from "axios";
import { IdToken, CognitoTokens } from "../interfaces";
Router.events.on("routeChangeStart", () => {
NProgress.start();
});
Router.events.on("routeChangeComplete", () => NProgress.done());
Router.events.on("routeChangeError", () => NProgress.done());
NProgress.configure({ showSpinner: false });
type tProps = {
passport?: {};
};
class MyApp extends App {
static async getInitialProps({ Component, ctx }: any) {
debugger;
let pageProps: tProps = {};
const session = await getSession({
req: ctx.req,
}); // this calls '/api/auth/session'
// let tokens: AuthTokens = {};
if (ctx.isServer && ctx.query?.code) {
const {
AUTH_DOMAIN,
COGNITO_CLIENT_ID,
COGNITO_CLIENT_SECRET,
BASE_URL,
} = process.env;
const { data }: { data: CognitoTokens } = await axios.post(
`https://${AUTH_DOMAIN}/oauth2/token?client_id=${COGNITO_CLIENT_ID}&client_secret=${COGNITO_CLIENT_SECRET}&grant_type=authorization_code&redirect_uri=${BASE_URL}&code=${ctx.query.code}`,
);
}
return { pageProps };
}
render() {
debugger
const { Component, pageProps, store }: any = this.props;
return (
<SessionProvider session={pageProps.session}>
<Provider store={store}>
<Component {...pageProps} />
<ReduxToastr
preventDuplicates
position="bottom-right"
transitionIn="fadeIn"
transitionOut="fadeOut"
timeOut={5000}
progressBar
/>
</Provider>
</SessionProvider>
);
}
}
export default withRedux(createStore)(MyApp);
pages/api/auth/[...nextauth].ts
import NextAuth from "next-auth";
import CognitoProvider from "next-auth/providers/cognito";
export default NextAuth({
providers: [
CognitoProvider({
clientId: process.env.COGNITO_CLIENT_ID,
clientSecret: process.env.COGNITO_CLIENT_SECRET,
issuer: process.env.COGNITO_ISSUER,
}),
],
debug: process.env.NODE_ENV === "development" ? true : false,
});
There is authentication middleware defined for the API. The main reason for this is that we have a custom permissions attribute defined on a user in Cognito which defines what CRUD operations they can do in specific environments
server/index.ts
import express from "express";
import next from "next";
import bodyParser from "body-parser";
import session from "express-session";
import connectMongodbSession from "connect-mongodb-session";
// Config
import { /* auth0Strategy, */ getSessionConfig } from "./config";
const port = parseInt(process.env.PORT || "3000", 10);
const dev = process.env.NODE_ENV !== "production";
// API
import authAPI from "./api/auth";
import accountsAPI from "./api/accounts";
import usersAPI from "./api/users";
import jobsAPI from "./api/jobs";
import awsAPI from "./api/aws";
import completedJobsAPI from "./api/completedJobs";
// middleware
import { restrictAccess, checkPermissions } from "./middleware/auth";
// Server
const app = next({ dev });
const handle = app.getRequestHandler();
app.prepare().then(() => {
const server = express();
const MongoDBStore = connectMongodbSession(session);
const store = new MongoDBStore({
uri: process.env.MONGO_PROD_URL,
collection: "godfatherSessions",
});
server.use(bodyParser.json());
server.use(session(getSessionConfig(store)));
server.get("/healthcheck", async (req: any, res, next) => {
const { db } = req.session.req.sessionStore;
try {
await db.command({
ping: 1,
});
res.status(200).end();
} catch (err) {
next(err);
}
});
// Middleware
server.use(checkPermissions);
// API
server.use(authAPI);
server.use(accountsAPI, restrictAccess);
server.use(usersAPI, restrictAccess);
server.use(jobsAPI, restrictAccess);
server.use(awsAPI, restrictAccess);
server.use(completedJobsAPI, restrictAccess);
// Protected Page Routes
server.get("/accounts", restrictAccess, (req: any, res) =>
app.render(req, res, "/accounts", req.query),
);
server.get("/users", restrictAccess, (req: any, res) =>
app.render(req, res, "/users", req.query),
);
server.get("/jobs", restrictAccess, (req: any, res) =>
app.render(req, res, "/jobs", req.query),
);
server.get("/completedJobs", restrictAccess, (req: any, res) => {
app.render(req, res, "/completedJobs", req.query);
});
server.get("/debug-sentry", function mainHandler() {
throw new Error("My first Sentry error!");
});
// Fallback Routes
server.all("*", handle as any);
// The error handler must be before any other error middleware and after all controllers
// server.use(Sentry.Handlers.errorHandler());
server.listen(port, (err?: Error) => {
if (err) throw err;
console.log(
`> Server listening at http://localhost:${port} as ${
dev ? "development" : process.env.NODE_ENV
}`,
);
});
});
server/middleware/auth.ts
/* eslint-disable #typescript-eslint/camelcase */
import "cross-fetch/polyfill";
import { Request, Response, NextFunction } from "express";
import { ForbiddenError } from "../../util/errors";
import { Environments } from "../../interfaces";
import jwt_decode from "jwt-decode";
import { CognitoUser, CognitoUserPool } from "amazon-cognito-identity-js";
import { getSession } from "next-auth/react";
export async function checkPermissions(
req: CustomRequest,
res: Response,
next: NextFunction,
) {
const { path, method } = req;
const { authorization, env } = req.headers;
const session = await getSession({ req });
debugger;
if (
!req.url.includes("/api/") ||
["/api/auth/callback/cognito", "/api/auth/session"].includes(req.path)
) {
return next();
}
if (req.headers.env === "development") {
return next();
}
console.log(session);
if (!authorization) {
return res.status(401).redirect("/login");
}
const decoded: any = jwt_decode(authorization);
const invalidAuth = isInvalidAuth(decoded, path);
if (!invalidAuth) {
const userPool = new CognitoUserPool({
UserPoolId: process.env.COGNITO_USER_POOL_ID,
ClientId: process.env.COGNITO_CLIENT_ID,
});
const username = decoded.username || decoded["cognito:username"];
const cognitoUser = new CognitoUser({
Username: username,
Pool: userPool,
});
const userAttributes: any = await getUserAttributes(cognitoUser);
const permissions = userAttributes.permissions
.split(",")
.map(perm => `"${perm}"`);
const hasPermission = getHasPermission(
method,
permissions,
env as Environments,
);
if (!hasPermission) {
return res
.status(403)
.send(
new ForbiddenError(
"You do not have permission to perform this action.",
).toErrorObject(),
);
}
return next();
}
return next(invalidAuth);
}
The callback URL defined in Cognito app client is "http://localhost:3000/api/auth/callback/cognito" (for development purposes - as is highlighted in the example).
When running the application & logging in via the Cognito hosted UI, the 1st breakpoint hit is the debugger on L5 in checkPermissions. The session is null at this point & the path is /api/auth/session.
The issue comes when I step through past that breakpoint to return next() where I get the error(s) shown in the picture below. So these are ECONNRESET errors & if I let it run freely, these errors occur over & over again resulting in an EMFILE error every now & again until eventually the application crashes. No other breakpoints are hit.
Versions:
next: v9.3.5
next-auth: v4.1.0
Even though, by default, next-auth will use localhost:3000, I kept getting an ENOTFOUND error when I didn't define the URL in the .env so I set it to:
NEXTAUTH_URL=http://127.0.0.1:3000
After reading all docs & examples & several tutorials on how to do it (no one has done a tutorial on v4 - just v3) I'm still stumped

Answer 1

For me helped to remove .next/ and add these lines to .env
NODE_TLS_REJECT_UNAUTHORIZED="0"
NEXTAUTH_URL="http://127.0.0.1:3000"
NEXTAUTH_URL_INTERNAL="http://127.0.0.1:3000"
It seems to work very fine.