nextauthjs / nextauthjs/next-auth

[auth][warn][experimental-webauthn] messages flooding server logs

Open
#12,598 1 comment 19 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug triage
Dominant language
TypeScript
Stars
28.4k
Forks
4k
PR merge metrics
No merged PRs in 30d

Description

Environment

Environment

  Binaries:
    Node: 20.18.1 - C:\Program Files\nodejs\node.EXE
    npm: 11.0.0 - C:\Program Files\nodejs\npm.CMD
    pnpm: 8.15.5 - ~\AppData\Local\pnpm\pnpm.EXE
  Browsers:
    Chrome: 132.0.6834.160
    Edge: Chromium (127.0.2651.74)
    Internet Explorer: 11.0.22621.3527
  npmPackages:
    @auth/prisma-adapter: ^2.7.4 => 2.7.4
    next: ^14.2.23 => 14.2.23
    next-auth: ^5.0.0-beta.25 => 5.0.0-beta.25
    react: ^18.3.1 => 18.3.1

This also happens in

next: latest => 15.1.6 and on Linux.

Reproduction URL

https://github.com/wowtah/nextauth-warning-issue

Describe the issue

We are testing passkey's in our setup, by enabling the Passkey provider, together with

experimental: { enableWebAuthn: true },

This generates a flood of server messages, apparently every time the auth functions are called:

2025-02-02T12:47:37.769535909Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn
2025-02-02T12:47:42.872801347Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn
2025-02-02T12:47:47.954180876Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn
2025-02-02T12:47:53.050628166Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn
2025-02-02T12:47:58.146162387Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn
2025-02-02T12:48:03.265822795Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn
2025-02-02T12:48:08.370860334Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn
2025-02-02T12:48:13.477828537Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn
2025-02-02T12:48:18.600505736Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn
2025-02-02T12:48:23.721970711Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn
2025-02-02T12:48:28.817713774Z [auth][warn][experimental-webauthn] Read more: https://warnings.authjs.dev#experimental-webauthn

I am aware that this feature is experimental, but letting me know every time an auth function is used feels a bit excessive ;)

I already made a feature request for an option to disable the warning:
https://github.com/nextauthjs/next-auth/discussions/12584

But since this is making development nearly impossible now (my app uses auth quite heavily, and I need to check my logs frequently) I'm also reporting this as a bug.

Also, when checking https://warnings.authjs.dev#experimental-webauthn, there is nothing to read about this warning.

If there is documentation available on how to disable the warning, I could not find it.

How to reproduce

Enable Passkey provider.

Set
experimental: { enableWebAuthn: true },

Check server logs.

Expected behavior

It's fine if the module warns about experimental features during start-up or during build. But the warning now appears every time the auth function is called. That makes it a bit unworkable.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the flood by enabling the Passkey provider and experimental: { enableWebAuthn: true }, then inspect the warning path reached whenever the auth function is called. Compare logging during startup or build with logging during repeated auth calls; done means the experimental warning no longer floods server logs and its documentation is available at the linked warning page.

Written by the indexing model from the issue text.

Assessment

Tech stack
nextjs, typescript
Domain
authentication, observability
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.