在不同端口上运行多个 NextAuth 应用程序 - 被解除

Question

我正在 localhost:3000、localhost:3001 和 localhost:3002 上运行 3 个应用程序。我可以成功登录 localhost:3001，但是当我访问其他页面之一时，出现错误：

https://next-auth.js.org/errors#jwt_session_error decryption operation failed {
  message: 'decryption operation failed',
  stack: 'JWEDecryptionFailed: decryption operation failed\n' +
    '    at gcmDecrypt (webpack-internal:///(rsc)/./node_modules/jose/dist/node/cjs/runtime/decrypt.js:68:15)\n' +
    '    at decrypt (webpack-internal:///(rsc)/./node_modules/jose/dist/node/cjs/runtime/decrypt.js:91:20)\n' +
    '    at flattenedDecrypt (webpack-internal:///(rsc)/./node_modules/jose/dist/node/cjs/jwe/flattened/decrypt.js:117:52)\n' +
    '    at async compactDecrypt (webpack-internal:///(rsc)/./node_modules/jose/dist/node/cjs/jwe/compact/decrypt.js:20:23)\n' +
    '    at async jwtDecrypt (webpack-internal:///(rsc)/./node_modules/jose/dist/node/cjs/jwt/decrypt.js:10:23)\n' +
    '    at async Object.decode (webpack-internal:///(rsc)/./node_modules/next-auth/jwt/index.js:44:25)\n' +
    '    at async Object.session (webpack-internal:///(rsc)/./node_modules/next-auth/core/routes/session.js:25:34)\n' +
    '    at async AuthHandler (webpack-internal:///(rsc)/./node_modules/next-auth/core/index.js:161:37)\n' +
    '    at async NextAuthRouteHandler (webpack-internal:///(rsc)/./node_modules/next-auth/next/index.js:49:30)\n' +
    '    at async NextAuth._args$ (webpack-internal:///(rsc)/./node_modules/next-auth/next/index.js:83:24)\n' +
    '    at async eval (webpack-internal:///(rsc)/./node_modules/next/dist/server/future/route-modules/app-route/module.js:253:37)',
  name: 'JWEDecryptionFailed'
}

我的会话 cookie 已从 localhost:3001 中删除，从而取消了我的身份验证。

如何在同一台计算机上运行所有这些应用程序，而无需它们尝试使用彼此各自的令牌进行身份验证？

Answer 1

此问题可能是因为应用程序干扰彼此的身份验证令牌。

确保您的每个应用程序都使用唯一的会话 cookie 名称。这将防止他们覆盖或干扰彼此的 cookie。在 Next.js 中，您可以在配置身份验证提供程序时使用 cookie 选项设置会话 cookie 名称：

// Application 1 (localhost:3000)
const options = {
  providers: [
    // ...other providers
  ],
  cookies: {
    sessionTokenName: 'app1SessionToken',
    // ...other cookie options
  },
};

确保每个应用程序使用不同的 JWT 密钥进行令牌加密和解密。 JWT 密钥用于签名和验证令牌，拥有不同的密钥将阻止跨应用程序令牌验证。您应该使用其唯一的 JWT 密钥来配置每个应用程序

// Application 1 (localhost:3000)
const options = {
  providers: [
    // ...other providers
  ],
  secret: 'app1-secret-key',
};