microsoft / microsoft/azurechat

npm "next" 14.0.4 module high severity vulnerability and breaking change

Open
#440 6 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
1.4k
Forks
1.3k
Avg merge
1d 11h
Merged PRs (30d)
1

Description

In working on this locally, running "npm install" showed that there were some packages that needed to be updated, so I updated them, however, there was one package, next, that it didn't update because doing so would be outside the stated dependency range. If I force the update, or change the dependency range (after all other packages have been updated), it beaks the ability to login (this is for version 14.2.14 of next). After successfully authenticating it redirects you back to the login page, and I see the following errors:

From the terminal in VS Code:

unhandledRejection: Error: NEXT_REDIRECT
    at getRedirectError (webpack-internal:///(rsc)/./node_modules/next/dist/client/components/redirect.js:49:19)
    at redirect (webpack-internal:///(rsc)/./node_modules/next/dist/client/components/redirect.js:60:11)
    at $$ACTION_1 (webpack-internal:///(rsc)/./features/common/navigation-helpers.ts:32:62)
    at redirectIfAuthenticated (webpack-internal:///(rsc)/./features/auth-page/helpers.ts:53:83)
    at async Home (webpack-internal:///(rsc)/./app/page.tsx:13:5) {
  digest: 'NEXT_REDIRECT;replace;/chat;307;',
  mutableCookies: p {
    _parsed: Map(3) {
      'next-auth.csrf-token' => [Object],
      'next-auth.callback-url' => [Object],
      'next-auth.session-token' => [Object]
    },
    _headers: HeadersList {
      cookies: [Array],
      [Symbol(headers map)]: [Map],
      [Symbol(headers map sorted)]: null
    }
  }
}

From the Debug Console in VS Code:

unhandledRejection: Error: NEXT_REDIRECT
    at getRedirectError (webpack-internal:///(rsc)/./node_modules/next/dist/client/components/redirect.js:49:19)
    at redirect (webpack-internal:///(rsc)/./node_modules/next/dist/client/components/redirect.js:60:11)
    at $$ACTION_1 (webpack-internal:///(rsc)/./features/common/navigation-helpers.ts:32:62)
    at redirectIfAuthenticated (webpack-internal:///(rsc)/./features/auth-page/helpers.ts:53:83)
    at async Home (webpack-internal:///(rsc)/./app/page.tsx:13:5) {digest: 'NEXT_REDIRECT;replace;/chat;307;', mutableCookies: Proxy(p), stack: 'Error: NEXT_REDIRECT
    at getRedirectError …ebpack-internal:///(rsc)/./app/page.tsx:13:5)', message: 'NEXT_REDIRECT'}

I've done some searching and testing of potential fixes but can't figure out how to resolve the issue. It appears to be related to how next handles the redirect (see this issue and this issue), but even after I've tried adding some try/catch blocks it still throws the same error and redirects to the login page. Any help would be much appreciated, thanks!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the login failure after updating Next to 14.2.14, then start with features/common/navigation-helpers.ts, features/auth-page/helpers.ts, and app/page.tsx from the reported stack trace. Compare the redirect behavior with the supported dependency range and verify that authentication reaches /chat without an unhandled NEXT_REDIRECT or returning to the login page.

Written by the indexing model from the issue text.

Assessment

Tech stack
next.js, typescript
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.