AstroAuthHandler attempts to modify immutable headers

[tueborabrian]

Using Credentials Provider with auth-astro along with the default signin page to handle authentication against an existing API that returns a cookie. This invokes AstroAuthHandler in server.ts, which attempts to extract cookies from the included with the response provided by the call to Auth. This causes a CredentialsSignin error because the attempt to delete the set-cookie header fails due to the headers being immutable.

I think this can be fixed by extracting the headers into a new object, extracting the cookies and removing the set-cookie header, and then creating a new response with the returned body and modified headers.

I patched the module in my local environment and it seems to work:

function AstroAuthHandler(prefix: string, options = authConfig) {
	return async ({ cookies, request }: APIContext) => {
		const url = new URL(request.url)
		const action = url.pathname.slice(prefix.length + 1).split('/')[0] as AuthAction

		if (!actions.includes(action) || !url.pathname.startsWith(prefix + '/')) return

		const res = await Auth(request, options)
		if (['callback', 'signin', 'signout'].includes(action)) {
			// Properly handle multiple Set-Cookie headers (they can't be concatenated in one)
			const headers = new Headers(res.headers)
			headers.getSetCookie().forEach((cookie) => {
				const { name, value, ...options } = parseString(cookie)
				// Astro's typings are more explicit than @types/set-cookie-parser for sameSite
				cookies.set(name, value, options as Parameters<(typeof cookies)['set']>[2])
			})
			headers.delete('Set-Cookie')
			return new Response(res.body, { headers })
		}
		return res
	}
}

I hope to submit a PR with this fix as soon as I get the module built in my environment so I can run tests.

[tueborabrian]

Nevermind. I guess I was doing something wrong in my configuration. Everything is working now.

[taciturnaxolotl]

Did you figure out what you were doing wrong? I'm having this same issue with the slack integration.

[jimlundblad]

Did you figure out what was wrong I am getting the same error.

Stack Trace TypeError: immutable at _Headers.delete (node:internal/deps/undici/undici:2356:17)
it's the bare minimum setup:

import Auth0 from "@auth/core/providers/auth0"

export default {
    providers: [
        Auth0({
            clientId: import.meta.env.AUTH0_ID,
            clientSecret: import.meta.env.AUTH0_SECRET,
            issuer: `https://${import.meta.env.AUTH0_DOMAIN}`
        })    
    ]
  }

Nevermind. I guess I was doing something wrong in my configuration. Everything is working now.

[taciturnaxolotl]

I was able to fix it for me by adding a few config options as described here: #58 (comment). I hope that works for you!