fix: support AUTH_SECRET for compat with npx auth secret

Author: balazsorban44

Diff for: packages/next-auth/src/jwt/index.ts

@@ -80,7 +80,7 @@ export async function getToken<R extends boolean = false>(
     raw,
     decode: _decode = decode,
     logger = console,
-    secret = process.env.NEXTAUTH_SECRET,
+    secret = process.env.NEXTAUTH_SECRET ?? process.env.AUTH_SECRET,
   } = params
 
   if (!req) throw new Error("Must pass `req` to JWT getToken()")

Diff for: packages/next-auth/src/next/index.ts

@@ -27,7 +27,10 @@ async function NextAuthApiHandler(
 ) {
   const { nextauth, ...query } = req.query
 
-  options.secret ??= options.jwt?.secret ?? process.env.NEXTAUTH_SECRET
+  options.secret ??=
+    options.jwt?.secret ??
+    process.env.NEXTAUTH_SECRET ??
+    process.env.AUTH_SECRET
 
   const handler = await AuthHandler({
     req: {
@@ -71,7 +74,7 @@ async function NextAuthRouteHandler(
   context: RouteHandlerContext,
   options: AuthOptions
 ) {
-  options.secret ??= process.env.NEXTAUTH_SECRET
+  options.secret ??= process.env.NEXTAUTH_SECRET ?? process.env.AUTH_SECRET
 
   // eslint-disable-next-line @typescript-eslint/no-var-requires
   const { headers, cookies } = require("next/headers")
@@ -175,7 +178,7 @@ export async function getServerSession<
   O extends GetServerSessionOptions,
   R = O["callbacks"] extends { session: (...args: any[]) => infer U }
     ? U
-    : Session,
+    : Session
 >(...args: GetServerSessionParams<O>): Promise<R | null> {
   const isRSC = args.length === 0 || args.length === 1
 
@@ -198,7 +201,7 @@ export async function getServerSession<
     options = Object.assign({}, args[2], { providers: [] })
   }
 
-  options.secret ??= process.env.NEXTAUTH_SECRET
+  options.secret ??= process.env.NEXTAUTH_SECRET ?? process.env.AUTH_SECRET
 
   const session = await AuthHandler<Session | {} | string>({
     options,
@@ -233,7 +236,7 @@ export async function unstable_getServerSession<
   O extends GetServerSessionOptions,
   R = O["callbacks"] extends { session: (...args: any[]) => infer U }
     ? U
-    : Session,
+    : Session
 >(...args: GetServerSessionParams<O>): Promise<R | null> {
   if (!deprecatedWarningShown && process.env.NODE_ENV !== "production") {
     console.warn(
@@ -250,6 +253,8 @@ declare global {
   namespace NodeJS {
     interface ProcessEnv {
       NEXTAUTH_URL?: string
+      NEXTAUTH_SECRET?: string
+      AUTH_SECRET?: string
       VERCEL?: "1"
     }
   }

Diff for: packages/next-auth/src/next/middleware.ts

@@ -118,7 +118,8 @@ async function handleMiddleware(
     return
   }
 
-  const secret = options?.secret ?? process.env.NEXTAUTH_SECRET
+  const secret =
+    options?.secret ?? process.env.NEXTAUTH_SECRET ?? process.env.AUTH_SECRET
   if (!secret) {
     console.error(
       `[next-auth][error][NO_SECRET]`,