Bug Description
NextAuth uses an HKDF (HMAC-based Extract-and-Expand Key Derivation Function) to derive the encryption key for JWT session tokens. When Next.js API routes decode the cookie on the server using getServerSession or getToken, they inherently use the session cookie name (e.g., "next-auth.session-token") as the salt parameter.
However, the standalone encode utility from next-auth/jwt defaults to an empty string ("") for the salt if one is not explicitly provided. Because buildSessionCookie() omitted the salt argument, the generated mock token was encrypted with a different key than the server expected. When Playwright sends an HTTP request (via page.context().request.get(...)) with this cookie, the Next.js API route fails to decrypt it, treats the user as unauthenticated, and incorrectly returns a 401 Unauthorized.
Steps to Reproduce
Run the Playwright test suite targeting the API endpoints.
The "[API E2E] /api/metrics/contributions returns 200 with valid session cookie" test executes and generates a token via buildSessionCookie().
encode() derives the encryption key using the default empty salt "".
Playwright attaches the improperly salted cookie and directly invokes the Next.js backend API route.
The server's NextAuth logic attempts to decrypt the cookie using "next-auth.session-token" as the salt.
Decryption fails due to the mismatched HKDF salts, yielding an unauthenticated state (null session).
The API route rejects the request and returns a 401 Unauthorized status, causing the expect(status).not.toBe(401) assertion to fail.
Affected Area
Other
Screenshots
No response
Browser & OS
No response
Environment
None
Additional Context
No response
Bug Description
NextAuth uses an HKDF (HMAC-based Extract-and-Expand Key Derivation Function) to derive the encryption key for JWT session tokens. When Next.js API routes decode the cookie on the server using getServerSession or getToken, they inherently use the session cookie name (e.g., "next-auth.session-token") as the salt parameter.
However, the standalone encode utility from next-auth/jwt defaults to an empty string ("") for the salt if one is not explicitly provided. Because buildSessionCookie() omitted the salt argument, the generated mock token was encrypted with a different key than the server expected. When Playwright sends an HTTP request (via page.context().request.get(...)) with this cookie, the Next.js API route fails to decrypt it, treats the user as unauthenticated, and incorrectly returns a 401 Unauthorized.
Steps to Reproduce
Run the Playwright test suite targeting the API endpoints.
The "[API E2E] /api/metrics/contributions returns 200 with valid session cookie" test executes and generates a token via buildSessionCookie().
encode() derives the encryption key using the default empty salt "".
Playwright attaches the improperly salted cookie and directly invokes the Next.js backend API route.
The server's NextAuth logic attempts to decrypt the cookie using "next-auth.session-token" as the salt.
Decryption fails due to the mismatched HKDF salts, yielding an unauthenticated state (null session).
The API route rejects the request and returns a 401 Unauthorized status, causing the expect(status).not.toBe(401) assertion to fail.
Affected Area
Other
Screenshots
No response
Browser & OS
No response
Environment
None
Additional Context
No response