fix(deps): update dependency next-auth to v4.5.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next-auth (source)	4.3.4 -> 4.5.0

GitHub Vulnerability Alerts

CVE-2022-31093

Impact

An attacker can send a request to an app using NextAuth.js with an invalid callbackUrl query parameter, which internally we convert to a URL object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to our API route handler timing out and logging in to fail. This has been remedied in the following releases:

next-auth v3 users before version 3.29.5 are impacted. (We recommend upgrading to v4, as v3 is considered unmaintained. See our migration guide)

next-auth v4 users before version 4.5.0 are impacted.

Patches

We've released patches for this vulnerability in:

• v3 - 3.29.5
• v4 - 4.5.0

You can do:

npm i next-auth@latest

or

yarn add next-auth@latest

or

pnpm add next-auth@latest

(This will update to the latest v4 version, but you can change latest to 3 if you want to stay on v3. This is not recommended.)

Workarounds

If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Here is an example:

Before:

// pages/api/auth/[...nextauth].js
import NextAuth from "next-auth"

export default NextAuth(/* your config */)

After:

// pages/api/auth/[...nextauth].js
import NextAuth from "next-auth"

function isValidHttpUrl(url) {
  try {
    return /^https?:/.test(url).protocol
  } catch {
    return false;
  }
}

export default async function handler(req, res) {
  if (
    req.query.callbackUrl &&
    !isValidHttpUrl(req.query.callbackUrl)
  ) {
   return res.status(500).send('');
  }
  
  return await NextAuth(req, res, /* your config */)
}

References

This vulnerability was discovered not long after GHSA-q2mx-j4x2-2h74 was published and is very similar in nature.

Related documentation:

• https://next-auth.js.org/getting-started/client#specifying-a-callbackurl
• https://next-auth.js.org/configuration/callbacks#redirect-callback

A test case has been added so this kind of issue will be checked before publishing. See: nextauthjs/next-auth@e498483

For more information

If you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability

Timeline

The issue was reported 2022 June 10th, a response was sent out to the reporter in less than 2 hours, and a patch was published within 3 hours.

---

Release Notes

nextauthjs/next-auth

v4.5.0

Compare Source

Bugfixes

• don't show error on relative callbackUrl

v4.4.0

Compare Source

Features

• callback: return always status code 401 on error (#​4601) (4daa63d)
• middleware: support custom cookieName (#​4385) (7d8cc70)
• middleware: support custom jwt.decode (#​4210) (16622f6)
• provider: Add United Effects provider (#​4546) (81afeef)
• providers: make issuer configurable on Salesforce (#​4658) (358b80d)

Bugfixes

• middleware: use relative URL for sign-in page callbackUrl (#​4534) (75602a3)
• ts: allow getToken in getServerSideProps (#​4659) (e4ee520)
• ts: remove unused type (#​4657) (0a7a916)
• ts: signIn infer provider type (#​4623) (46089eb)
• handle invalid callbackUrl

Other

• signout: fix skipped test (#​4484) (0b953bd)

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Mend Renovate. View repository job log here.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[github-actions]

🎉 Deployment for commit 6c0e372 :

Ingresses

• 🚀 mon-psy-sante-renovate-npm-next-auth-vulner-5y15oi.dev.fabrique.social.gouv.fr
• 🚀 keycloak-mon-psy-sante-renovate-npm-next-auth-vulner-5y15oi.dev.fabrique.social.gouv.fr

Docker images

• 📦 docker pull ghcr.io/socialgouv/mon-psy-sante/app:sha-6c0e3728e655a586185d0f0647fa9ab7c27686d9

Debug

• 📕 Loki logs for namespace mon-psy-sante-renovate-npm-next-auth-vulnerability-2uh8w3
• 📈 Pods monitoring for namespace mon-psy-sante-renovate-npm-next-auth-vulnerability-2uh8w3
• 📈 Workloads monitoring for namespace mon-psy-sante-renovate-npm-next-auth-vulnerability-2uh8w3
• 👮‍♂️ Project rancher mon-psy-sante-renovate-npm-next-auth-vulnerability-2uh8w3