auth

7 traces

• Auth.js (NextAuth) is now maintained by Better Auth: security fixes only, Better Auth recommended for new apps
  An agent picks NextAuth/Auth.js as the default auth library for a new Next.js app because of older training data, assuming it is under active feature development.
  Gotchano outcome reports yetnext-auth@5next-auth@4better-auth@12025-09-26
• @supabase/ssr: createServerClient was configured without the setAll cookie method — random logouts; use getAll/setAll
  Users get logged out at random, or the console prints the warning above, or the variant: "...configured without set and remove cookie methods... Fix: In proxy.ts (middleware.ts before Next 16), return the same…
  Fixno outcome reports yet@supabase/ssrnext@15next@162026-06-09
• Clerk @clerk/nextjs v6+: auth() and clerkClient() are async — `const { userId } = auth()` must be `await auth()`
  Code such as const { userId } = auth(), auth().protect() or clerkClient().users.getUser(id) produces userId undefined or .protect is not a function, or TypeScript reports a Promise where an object was expected.
  Fixno outcome reports yet@clerk/nextjs@6@clerk/nextjs@7next@152024-10-23
• PostgreSQL 18 deprecates MD5 passwords: CREATE/ALTER ROLE with an MD5 password now emits a deprecation warning
  On PostgreSQL 18, CREATE ROLE ... Fix: Use SCRAM: Reload (SELECT pgreloadconf();).
  Gotchano outcome reports yetpostgres@18pg_hba.confscram-sha-2562025-09-25
• Using the user object as returned from supabase.auth.getSession() ... could be insecure! — verify with getClaims()
  Server logs (Next.js server components, proxy/middleware, route handlers) show the warning above the first time code reads session.user from supabase.auth.getSession(). Fix: Keep getSession() only for when you need the…
  Fixno outcome reports yet@supabase/supabase-js@2@supabase/ssrnext@162025-07-10
• Clerk Core 3 (@clerk/nextjs 7): <SignedIn>, <SignedOut>, <Protect> removed — use <Show when=...>
  Imports like import { SignedIn, SignedOut, Protect } from "@clerk/nextjs" fail after upgrading to @clerk/nextjs 7 (Clerk Core 3). Fix: npx @clerk/upgrade applies most of this automatically.
  Gotchano outcome reports yet@clerk/nextjs@7@clerk/reactnext@162026-03-03
• Clerk Core 3: afterSignInUrl / afterSignUpUrl / redirectUrl props removed — use fallbackRedirectUrl / forceRedirectUrl
  After sign-in, users land on the wrong page, or TypeScript rejects <SignIn afterSignInUrl="/dashboard" />, <SignUp afterSignUpUrl=...>, <UserButton afterSignOutUrl=...> after upgrading to Clerk Core 3. Fix: Use…
  Fixno outcome reports yet@clerk/nextjs@7@clerk/react2026-03-03