Unable to redirect to sign in/login page when auth fails in a server action

Environment

  System:
    OS: macOS 15.5
    CPU: (8) arm64 Apple M1
    Memory: 104.33 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 24.3.0 - /opt/homebrew/bin/node
    npm: 11.4.2 - /opt/homebrew/bin/npm
    pnpm: 9.12.3 - /opt/homebrew/bin/pnpm
  Browsers:
    Chrome: 138.0.7204.101
    Safari: 18.5
  npmPackages:
    @auth/unstorage-adapter: ^2.0.0 => 2.9.1 
    next: latest => 15.3.3 
    next-auth: beta => 5.0.0-beta.28 
    react: ^18.2.0 => 18.3.1 

Reproduction URL

https://github.com/Inokinoki/next-auth-redirect

Describe the issue

When the auth failed during a server action (a POST action) is performing (e.g. the auth expired), next-auth attempts to redirect using 307 Temporary Redirect to go to the login page.

However, in Next.js, this will lead to a redirection of the server action request itself, where the server action gets the login page with the original request method (POST for the case of server action), which does not redirect the application to the login page.

For the auth backend requiring forcefully GET as the request method, this will lead to a failed response with 405 Method Not Allowed.

How to reproduce

Setup an auth backend (auth0 in my case), and then:

1. Run the application using pnpm as shown in the README.
2. Go to http://localhost:3000/server-action that created by me, which contains a button to perform server action, user needs to sign in to get it
3. Click the "Create" button to trigger the server action, there will be 1/10 probabilities that the auth fails (to simulate the failed auth due to expired token, for instance)
4. Check the behaviors and the HTTP status, an example here:

We can see that the server action request is redirected and got the sign in page as the response content, and it does not trigger an application redirection, which causes confusions.

Expected behavior

It should give 303 See Others according to Next.js documentation, and redirect the app to the login page without failing the server action and staying at the same page.

A promising solution could be to use Next.js extended Response.redirect instead of the one from the standard, it could have been distinguishing the server action env, the middleware env, etc. to return the right status code.

But I'm not very sure. So maybe explicitly adding 303 as the status code to the Response.redirect call is more under control.

Start with the linked reproduction repository, its README, and the /server-action page to observe the failed POST flow. Trace how the authentication failure redirects and verify that server actions produce a 303 response, navigate the application to the login page, and avoid returning the login page as the POST response.