Fix Auth.js post-login redirects landing on 0.0.0.0 behind Docker.

Prefer NEXT_PUBLIC_APP_URL/AUTH_URL when HOSTNAME bind address leaks into redirect origins after Google OAuth.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Tomkoooo

packages/core/src/app/auth/admin-callback/route.ts

@@ -1,19 +1,20 @@
 import { NextResponse } from "next/server"
 import { auth } from "@wse/core/auth"
+import { absoluteAppUrl } from "@wse/core/lib/auth-redirect"
 import { activeOrgCookieOptions } from "@wse/plugin-t-book/lib/org-cookie"
 import { resolveTBookPostLoginTarget } from "@wse/plugin-t-book/lib/post-login-redirect"
 
 export async function GET(request: Request) {
   const session = await auth()
   if (!session?.user) {
-    return NextResponse.redirect(new URL("/auth/admin-login", request.url))
+    return NextResponse.redirect(absoluteAppUrl("/auth/admin-login", request.url))
   }
 
   const url = new URL(request.url)
   const callbackUrl = url.searchParams.get("callbackUrl")
   const { redirectPath, autoSelectOrgId } = await resolveTBookPostLoginTarget(callbackUrl)
 
-  const response = NextResponse.redirect(new URL(redirectPath, request.url))
+  const response = NextResponse.redirect(absoluteAppUrl(redirectPath, request.url))
 
   if (autoSelectOrgId) {
     const cookie = activeOrgCookieOptions(autoSelectOrgId)

packages/core/src/auth.config.ts

@@ -1,5 +1,6 @@
 import type { NextAuthConfig } from "next-auth"
 import Google from "next-auth/providers/google"
+import { resolveAuthRedirectUrl } from "@wse/core/lib/auth-redirect"
 
 type Role = "ADMIN" | "USER"
 
@@ -11,6 +12,13 @@ export const authConfig = {
     }),
   ],
   callbacks: {
+    /**
+     * Docker sets HOSTNAME=0.0.0.0 for binding; Auth.js can infer that as the redirect
+     * origin after OAuth. Always prefer NEXT_PUBLIC_APP_URL / AUTH_URL.
+     */
+    async redirect({ url, baseUrl }) {
+      return resolveAuthRedirectUrl(url, baseUrl)
+    },
     async session({ session, token }) {
       if (session.user) {
         if (token.sub) {

packages/core/src/lib/auth-redirect.ts

@@ -1,5 +1,98 @@
+import { getPublicAppBaseUrl, isLocalhostBaseUrl } from "@wse/core/lib/app-base-url"
+
 /** Build login path preserving return URL after Google sign-in. */
 export function authLoginPath(callbackUrl: string): string {
-  const params = new URLSearchParams({ callbackUrl });
-  return `/auth/login?${params.toString()}`;
+  const params = new URLSearchParams({ callbackUrl })
+  return `/auth/login?${params.toString()}`
+}
+
+/**
+ * Hosts that must never appear in browser redirects (Docker bind address, loopback).
+ * Auth.js + `HOSTNAME=0.0.0.0` commonly produces `https://0.0.0.0:3000/...` after OAuth.
+ */
+export function isUnusableRedirectHost(hostname: string): boolean {
+  const host = hostname.trim().toLowerCase().replace(/^\[|\]$/g, "")
+  return (
+    host === "0.0.0.0" ||
+    host === "::" ||
+    host === "localhost" ||
+    host === "127.0.0.1" ||
+    host === "::1"
+  )
+}
+
+function tryPublicBaseUrl(): string | null {
+  try {
+    return getPublicAppBaseUrl().replace(/\/+$/, "")
+  } catch {
+    return null
+  }
+}
+
+function resolveBase(fallbackBaseUrl?: string): URL {
+  const configured = tryPublicBaseUrl()
+  const candidates = [configured, fallbackBaseUrl, "http://localhost:3000"].filter(
+    (v): v is string => Boolean(v?.trim())
+  )
+
+  for (const raw of candidates) {
+    try {
+      const base = new URL(raw.includes("://") ? raw.replace(/\/+$/, "") : `https://${raw}`)
+      if (isUnusableRedirectHost(base.hostname)) continue
+      if (process.env.NODE_ENV === "production" && isLocalhostBaseUrl(base.origin) && configured) {
+        continue
+      }
+      return base
+    } catch {
+      /* try next */
+    }
+  }
+
+  return new URL("http://localhost:3000")
+}
+
+/**
+ * Resolve Auth.js / route-handler redirects onto the configured public origin.
+ * Rewrites absolute URLs that landed on `0.0.0.0` / loopback (Docker HOSTNAME bind).
+ */
+export function resolveAuthRedirectUrl(url: string, fallbackBaseUrl?: string): string {
+  const base = resolveBase(fallbackBaseUrl)
+  const trimmed = url.trim()
+  if (!trimmed) return base.origin
+
+  if (trimmed.startsWith("/") && !trimmed.startsWith("//")) {
+    return `${base.origin}${trimmed}`
+  }
+
+  try {
+    const parsed = new URL(trimmed)
+    if (isUnusableRedirectHost(parsed.hostname)) {
+      return `${base.origin}${parsed.pathname}${parsed.search}${parsed.hash}`
+    }
+    if (parsed.origin === base.origin) {
+      return parsed.toString()
+    }
+    // Auth.js may pass its inferred baseUrl origin (wrong behind Docker). If the path is
+    // on that inferred origin, move it onto the public origin.
+    if (fallbackBaseUrl) {
+      try {
+        const inferred = new URL(fallbackBaseUrl)
+        if (parsed.origin === inferred.origin) {
+          return `${base.origin}${parsed.pathname}${parsed.search}${parsed.hash}`
+        }
+      } catch {
+        /* ignore */
+      }
+    }
+    // Foreign absolute URL — do not open-redirect; send home.
+    return base.origin
+  } catch {
+    return base.origin
+  }
+}
+
+/** Absolute URL for an app path, preferring NEXT_PUBLIC_APP_URL / AUTH_URL. */
+export function absoluteAppUrl(path: string, requestUrl?: string): string {
+  const normalized = path.startsWith("/") ? path : `/${path}`
+  return resolveAuthRedirectUrl(normalized, requestUrl)
 }

packages/core/src/middleware.ts

@@ -42,13 +42,39 @@ function rewriteOrRedirectUrl(req: MiddlewareReq, pathname: string): URL {
   url.search = req.nextUrl.search
 
   const forwardedHost = req.headers.get("x-forwarded-host") ?? req.headers.get("host")
-  if (forwardedHost) {
-    url.host = forwardedHost.split(",")[0]!.trim()
+  const hostCandidate = forwardedHost?.split(",")[0]?.trim() ?? ""
+  const hostNameOnly = hostCandidate.split(":")[0] ?? ""
+
+  const unusable =
+    !hostCandidate ||
+    hostNameOnly === "0.0.0.0" ||
+    hostNameOnly === "localhost" ||
+    hostNameOnly === "127.0.0.1"
+
+  if (!unusable) {
+    url.host = hostCandidate
+    const forwardedProto = req.headers.get("x-forwarded-proto")
+    if (forwardedProto) {
+      url.protocol = `${forwardedProto.split(",")[0]!.trim()}:`
+    }
+    return url
   }
-  const forwardedProto = req.headers.get("x-forwarded-proto")
-  if (forwardedProto) {
-    url.protocol = `${forwardedProto.split(",")[0]!.trim()}:`
+
+  // Docker HOSTNAME=0.0.0.0 (or missing forwarded host): fall back to public env URL.
+  for (const key of ["NEXT_PUBLIC_APP_URL", "AUTH_URL", "NEXTAUTH_URL"] as const) {
+    const raw = process.env[key]?.trim()
+    if (!raw) continue
+    try {
+      const pub = new URL(raw)
+      if (pub.hostname === "0.0.0.0") continue
+      url.protocol = pub.protocol
+      url.host = pub.host
+      return url
+    } catch {
+      /* try next */
+    }
   }
+
   return url
 }
 
@@ -86,14 +112,14 @@ export const storefrontMiddleware = auth(async (req) => {
   const maintenanceEnabled = isConfiguredMaintenanceEnabled()
   const isAdminUser = req.auth?.user?.role === "ADMIN"
   if (maintenanceEnabled && !isAdminUser) {
-    return NextResponse.redirect(new URL("/maintenance", req.nextUrl))
+    return NextResponse.redirect(rewriteOrRedirectUrl(req, "/maintenance"))
   }
 
   const isLoggedIn = !!req.auth
   const isAdminPath = pathname.startsWith("/admin")
 
   if (isAdminPath && !isLoggedIn) {
-    const signInUrl = new URL("/auth/admin-login", req.nextUrl)
+    const signInUrl = rewriteOrRedirectUrl(req, "/auth/admin-login")
     signInUrl.searchParams.set("callbackUrl", "/admin")
     return NextResponse.redirect(signInUrl)
   }

tests/unit/auth-redirect.test.ts

@@ -0,0 +1,49 @@
+import { afterEach, describe, expect, it, vi } from "vitest"
+import {
+  absoluteAppUrl,
+  isUnusableRedirectHost,
+  resolveAuthRedirectUrl,
+} from "../../packages/core/src/lib/auth-redirect"
+
+describe("auth-redirect", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it("flags Docker bind / loopback hosts", () => {
+    expect(isUnusableRedirectHost("0.0.0.0")).toBe(true)
+    expect(isUnusableRedirectHost("127.0.0.1")).toBe(true)
+    expect(isUnusableRedirectHost("localhost")).toBe(true)
+    expect(isUnusableRedirectHost("ugyved.testsrt.org.hu")).toBe(false)
+  })
+
+  it("rewrites 0.0.0.0 post-login redirects onto AUTH_URL", () => {
+    vi.stubEnv("NEXT_PUBLIC_APP_URL", "https://ugyved.testsrt.org.hu")
+    vi.stubEnv("AUTH_URL", "https://ugyved.testsrt.org.hu")
+    vi.stubEnv("NODE_ENV", "production")
+
+    expect(resolveAuthRedirectUrl("https://0.0.0.0:3000/admin")).toBe(
+      "https://ugyved.testsrt.org.hu/admin"
+    )
+    expect(resolveAuthRedirectUrl("/admin", "https://0.0.0.0:3000")).toBe(
+      "https://ugyved.testsrt.org.hu/admin"
+    )
+    expect(resolveAuthRedirectUrl("https://0.0.0.0:3000/auth/admin-callback?callbackUrl=%2Fadmin")).toBe(
+      "https://ugyved.testsrt.org.hu/auth/admin-callback?callbackUrl=%2Fadmin"
+    )
+  })
+
+  it("keeps same-origin public redirects", () => {
+    vi.stubEnv("NEXT_PUBLIC_APP_URL", "https://ugyved.testsrt.org.hu")
+    expect(resolveAuthRedirectUrl("https://ugyved.testsrt.org.hu/admin")).toBe(
+      "https://ugyved.testsrt.org.hu/admin"
+    )
+  })
+
+  it("absoluteAppUrl prefers public env over request.url", () => {
+    vi.stubEnv("NEXT_PUBLIC_APP_URL", "https://ugyved.testsrt.org.hu")
+    expect(absoluteAppUrl("/admin", "https://0.0.0.0:3000/auth/admin-callback")).toBe(
+      "https://ugyved.testsrt.org.hu/admin"
+    )
+  })
+})