npmpackage.info

Gathering detailed insights and metrics for next-auth

Other packages similar to next-auth

@next-auth/prisma-adapter

1.0.7

Prisma adapter for next-auth.

@auth/prisma-adapter

2.9.1

Prisma adapter for Auth.js

@next-auth/typeorm-legacy-adapter

2.0.2

TypeORM (legacy) adapter for next-auth.

@nuxtjs/auth-next

5.0.0-1667386184.dfbbb54

Authentication module for Nuxt.js

Gathering detailed insights and metrics for next-auth

next-auth - 4.24.11 | npmpackage.info

next-auth

Authentication for the Web.

4.24.11

26,810

ISC

TypeScript

82.78 kB

114,695,883 5.7

Installations

npm install next-auth

Developer Guide

BETA

Typescript

Yes

Module System

CommonJS, ESM

Node Version

20.8.0

NPM Version

10.1.0 Score

70.6

Supply Chain

83.2

Quality

92.8

Maintenance

Vulnerability

91.3

License

Pull Requests

Open

137

Total

3,219

Closed

878

Merged

2,204

Issues

Open

347

Total

4,915

Closed

4,568

Releases

1,727

next-auth@5.0.0-beta.28

Updated on May 10, 2025

@auth/qwik@0.7.1

Updated on May 10, 2025

@auth/azure-tables-adapter@1.9.1

Updated on May 10, 2025

@auth/d1-adapter@1.9.1

Updated on May 10, 2025

@auth/dgraph-adapter@2.9.1

Updated on May 10, 2025

@auth/drizzle-adapter@1.9.1

Updated on May 10, 2025

View All 1,727 releases

Languages

TypeScript

JavaScript

CSS

Shell

Svelte

PLpgSQL

Pug

Dockerfile

HTML

TypeScript (93.37%)

JavaScript (2.69%)

CSS (1.36%)

Shell (0.99%)

Svelte (0.94%)

PLpgSQL (0.25%)

Pug (0.24%)

Dockerfile (0.11%)

HTML (0.04%)

Developer

nextauthjs

Download Statistics

Total Downloads

114,695,883

Last Day

239,184

Last Week

1,493,520

Last Month

6,054,237

Last Year

58,079,832

GitHub Statistics

ISC License

26,810 Stars

3,893 Commits

3,834 Forks

110 Watchers

79 Branches

897 Contributors

Updated on May 24, 2025

Bundle Size

283.91 kB

Minified

82.78 kB

Minified + Gzipped

Bundlephobia

Maintainers

View All 897 Contributors

Package Meta Information

Latest Version

4.24.11

Package Id

next-auth@4.24.11

Unpacked Size

808.25 kB

Size

180.37 kB

File Count

486

NPM Version

10.1.0

Node Version

20.8.0

Published on

Dec 06, 2024

Total Downloads

Cumulative downloads

Total Downloads

114,695,883

Last Day

239,184

Compared to previous day

Last Week

5.8%

1,493,520

Compared to previous week

Last Month

0.9%

6,054,237

Compared to previous month

Last Year

65.8%

58,079,832

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

NextAuth.js

Authentication for Next.js

Open Source. Full Stack. Own Your Data.

Overview

NextAuth.js is a complete open source authentication solution for Next.js applications.

It is designed from the ground up to support Next.js and Serverless.

This is a monorepo containing the following packages / projects:

The primary next-auth package
A development test application
All @next-auth/*-adapter packages
The documentation site

Getting Started

npm install next-auth

The easiest way to continue getting started, is to follow the getting started section in our docs.

We also have a section of tutorials for those looking for more specific examples.

See next-auth.js.org for more information and documentation.

Features

Flexible and easy to use

Designed to work with any OAuth service, it supports OAuth 1.0, 1.0A and 2.0
Built-in support for many popular sign-in services
Supports email / passwordless authentication
Supports stateless authentication with any backend (Active Directory, LDAP, etc)
Supports both JSON Web Tokens and database sessions
Designed for Serverless but runs anywhere (AWS Lambda, Docker, Heroku, etc…)

Own your own data

NextAuth.js can be used with or without a database.

An open source solution that allows you to keep control of your data
Supports Bring Your Own Database (BYOD) and can be used with any database
Built-in support for MySQL, MariaDB, Postgres, Microsoft SQL Server, MongoDB and SQLite
Works great with databases from popular hosting providers
Can also be used without a database (e.g. OAuth + JWT)

Secure by default

Promotes the use of passwordless sign-in mechanisms
Designed to be secure by default and encourage best practices for safeguarding user data
Uses Cross-Site Request Forgery (CSRF) Tokens on POST routes (sign in, sign out)
Default cookie policy aims for the most restrictive policy appropriate for each cookie
When JSON Web Tokens are enabled, they are encrypted by default (JWE) with A256GCM
Auto-generates symmetric signing and encryption keys for developer convenience
Features tab/window syncing and session polling to support short lived sessions
Attempts to implement the latest guidance published by Open Web Application Security Project

Advanced options allow you to define your own routines to handle controlling what accounts are allowed to sign in, for encoding and decoding JSON Web Tokens and to set custom cookie security policies and session properties, so you can control who is able to sign in and how often sessions have to be re-validated.

TypeScript

NextAuth.js comes with built-in types. For more information and usage, check out the TypeScript section in the documentation.

Example

Add API Route

1// pages/api/auth/[...nextauth].js
2import NextAuth from "next-auth"
3import AppleProvider from "next-auth/providers/apple"
4import GoogleProvider from "next-auth/providers/google"
5import EmailProvider from "next-auth/providers/email"
6
7export default NextAuth({
8  secret: process.env.SECRET,
9  providers: [
10    // OAuth authentication providers
11    AppleProvider({
12      clientId: process.env.APPLE_ID,
13      clientSecret: process.env.APPLE_SECRET,
14    }),
15    GoogleProvider({
16      clientId: process.env.GOOGLE_ID,
17      clientSecret: process.env.GOOGLE_SECRET,
18    }),
19    // Sign in with passwordless email link
20    EmailProvider({
21      server: process.env.MAIL_SERVER,
22      from: "<no-reply@example.com>",
23    }),
24  ],
25})

Add React Hook

The useSession() React Hook in the NextAuth.js client is the easiest way to check if someone is signed in.

1import { useSession, signIn, signOut } from "next-auth/react"
2
3export default function Component() {
4  const { data: session } = useSession()
5  if (session) {
6    return (
7      <>
8        Signed in as {session.user.email} <br />
9        <button onClick={() => signOut()}>Sign out</button>
10      </>
11    )
12  }
13  return (
14    <>
15      Not signed in <br />
16      <button onClick={() => signIn()}>Sign in</button>
17    </>
18  )
19}

Share/configure session state

Use the <SessionProvider> to allow instances of useSession() to share the session object across components. It also takes care of keeping the session updated and synced between tabs/windows.

1import { SessionProvider } from "next-auth/react"
2
3export default function App({
4  Component,
5  pageProps: { session, ...pageProps },
6}) {
7  return (
8    <SessionProvider session={session}>
9      <Component {...pageProps} />
10    </SessionProvider>
11  )
12}

Security

If you think you have found a vulnerability (or not sure) in NextAuth.js or any of the related packages (i.e. Adapters), we ask you to have a read of our Security Policy to reach out responsibly. Please do not open Pull Requests/Issues/Discussions before consulting with us.

Acknowledgments

NextAuth.js is made possible thanks to all of its contributors.

Support

We're happy to announce we've recently created an OpenCollective for individuals and companies looking to contribute financially to the project!

Clerk _💵	Auth0 _💵	FusionAuth _💵	Stytch _💵	Prisma _💵	Neon _💵
Beyond Identity _💵	Lowdefy _💵	Descope _💵	Badass Courses _💵	Encore _💵	Sent.dm _💵
Arcjet _💵	Route4Me _💵	Netlight _☁️	Checkly _☁️	superblog _☁️	Vercel _☁️

💵 Financial Sponsor
☁️ Infrastructure Support

Contributing

We're open to all community contributions! If you'd like to contribute in any way, please first read our Contributing Guide.

License

ISC

Critical

9.1/10

Summary

NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails

Affected Versions

< 3.29.10

Patched Versions

3.29.10

Critical

9.1/10

Summary

NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails

Affected Versions

>= 4.0.0, < 4.10.3

Patched Versions

4.10.3

High

8.1/10

Summary

Missing proper state, nonce and PKCE checks for OAuth authentication

Affected Versions

< 4.20.1

Patched Versions

4.20.1

High

7.1/10

Summary

Improper handling of email input

Affected Versions

>= 4.0.0, < 4.9.0

Patched Versions

4.9.0

High

7.1/10

Summary

Improper handling of email input

Affected Versions

< 3.29.8

Patched Versions

3.29.8

High

7.5/10

Summary

Improper Handling of `callbackUrl` parameter in next-auth

Affected Versions

>= 4.0.0, < 4.5.0

Patched Versions

4.5.0

High

7.5/10

Summary

Improper Handling of `callbackUrl` parameter in next-auth

Affected Versions

< 3.29.5

Patched Versions

3.29.5

Moderate

5.3/10

Summary

Possible user mocking that bypasses basic authentication

Affected Versions

< 4.24.5

Patched Versions

4.24.5

Moderate

6.1/10

Summary

URL Redirection to Untrusted Site ('Open Redirect') in next-auth

Affected Versions

>= 4.0.0, < 4.3.3

Patched Versions

4.3.3

Moderate

6.1/10

Summary

URL Redirection to Untrusted Site ('Open Redirect') in next-auth

Affected Versions

< 3.29.3

Patched Versions

3.29.3

Moderate

6.1/10

Summary

NextAuth.js default redirect callback vulnerable to open redirects

Affected Versions

>= 4.0.0, < 4.3.2

Patched Versions

4.3.2

Moderate

6.1/10

Summary

NextAuth.js default redirect callback vulnerable to open redirects

Affected Versions

< 3.29.2

Patched Versions

3.29.2

Low

3.3/10

Summary

next-auth before v4.10.2 and v3.29.9 leaks excessive information into log

Affected Versions

>= 4.0.0, < 4.10.2

Patched Versions

4.10.2

Low

3.3/10

Summary

next-auth before v4.10.2 and v3.29.9 leaks excessive information into log

Affected Versions

< 3.29.9

Patched Versions

3.29.9

Low

0/10

Summary

Token verification bug in next-auth

Affected Versions

< 3.3.0

Patched Versions

3.3.0

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Maintained

Determines if the project is "actively maintained".

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

License

Determines if the project has defined a license.

10

Security-Policy

Determines if the project has published a security policy.

9

SAST

Determines if the project uses static code analysis.

6

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/broken-link-checker.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/broken-link-checker.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/broken-link-checker.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/broken-link-checker.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/broken-link-checker.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/broken-link-checker.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-labeler.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/pr-labeler.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:143: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:149: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:151: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:172: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:174: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:176: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:195: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:211: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:213: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:215: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:122: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sync-examples.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/sync-examples.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/sync-examples.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/sync-examples.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/triage.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/nextauthjs/next-auth/triage.yml/main?enable=pin
Warn: containerImage not pinned by hash: apps/examples/nextjs/Dockerfile:2
Warn: containerImage not pinned by hash: apps/examples/nextjs/Dockerfile:5
Warn: containerImage not pinned by hash: apps/examples/nextjs/Dockerfile:15
Warn: containerImage not pinned by hash: apps/examples/nextjs/Dockerfile:28
Info: 0 out of 16 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 9 third-party GitHubAction dependencies pinned
Info: 0 out of 4 containerImage dependencies pinned

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Reason

73 existing vulnerabilities detected

Details

Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99
Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
Warn: Project is vulnerable to: GHSA-6g33-8w2q-4hxv
Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
Warn: Project is vulnerable to: GHSA-3787-6prv-h9w3
Warn: Project is vulnerable to: GHSA-9qxr-qj54-h672
Warn: Project is vulnerable to: GHSA-m4v8-wqvr-p9f7
Warn: Project is vulnerable to: GHSA-c76h-2ccp-4975
Warn: Project is vulnerable to: GHSA-cxrh-j4jr-qwg3
Warn: Project is vulnerable to: GHSA-mgfv-m47x-4wqp
Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
Warn: Project is vulnerable to: GHSA-g77x-44xx-532m
Warn: Project is vulnerable to: GHSA-gp8f-8m3g-qvj9
Warn: Project is vulnerable to: GHSA-7gfc-8cq8-jh5f
Warn: Project is vulnerable to: GHSA-7m27-7ghc-44w9
Warn: Project is vulnerable to: GHSA-qpjv-v59x-3qc4
Warn: Project is vulnerable to: GHSA-f82v-jwr5-mffw
Warn: Project is vulnerable to: GHSA-f7f6-9jq7-3rqj
Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
Warn: Project is vulnerable to: GHSA-cchq-frgv-rjh5
Warn: Project is vulnerable to: GHSA-g644-9gfx-q4q4
Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
Warn: Project is vulnerable to: GHSA-3qxh-p7jc-5xh6
Warn: Project is vulnerable to: GHSA-6q87-84jw-cjhp
Warn: Project is vulnerable to: GHSA-vg6x-rcgg-rjx6
Warn: Project is vulnerable to: GHSA-x574-m823-4x7w
Warn: Project is vulnerable to: GHSA-4r4m-qw57-chr8
Warn: Project is vulnerable to: GHSA-xcj6-pq6g-qj4x
Warn: Project is vulnerable to: GHSA-356w-63v5-8wf4
Warn: Project is vulnerable to: GHSA-859w-5945-r5v3
Warn: Project is vulnerable to: GHSA-m5vv-6r4h-3vj9
Warn: Project is vulnerable to: GHSA-mh2x-fcqh-fmqv
Warn: Project is vulnerable to: GHSA-rjjv-87mx-6x3h
Warn: Project is vulnerable to: GHSA-fg4m-w35q-vfg2
Warn: Project is vulnerable to: GHSA-vhxf-7vqr-mrjg
Warn: Project is vulnerable to: GHSA-f6v4-cf5j-vf3w
Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6
Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
Warn: Project is vulnerable to: GHSA-75v8-2h7p-7m2m
Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
Warn: Project is vulnerable to: GHSA-8cf7-32gw-wr33
Warn: Project is vulnerable to: GHSA-hjrf-2m68-5959
Warn: Project is vulnerable to: GHSA-qwph-4952-7xr6
Warn: Project is vulnerable to: GHSA-3wc5-fcw2-2329
Warn: Project is vulnerable to: GHSA-64fm-8hw2-v72w
Warn: Project is vulnerable to: GHSA-cvr6-37gx-v8wc
Warn: Project is vulnerable to: GHSA-f98w-7cxr-ff2h
Warn: Project is vulnerable to: GHSA-cg87-wmx4-v546
Warn: Project is vulnerable to: GHSA-pmh2-wpjm-fj45
Warn: Project is vulnerable to: GHSA-9h6g-pr28-7cqp
Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
Warn: Project is vulnerable to: GHSA-x7hr-w5r2-h6wg
Warn: Project is vulnerable to: GHSA-3965-hpx2-q597
Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx
Warn: Project is vulnerable to: GHSA-64vr-g452-qvp3
Warn: Project is vulnerable to: GHSA-9cwx-2883-4wfx
Warn: Project is vulnerable to: GHSA-9crc-q9x8-hgqq
Warn: Project is vulnerable to: GHSA-g3ch-rx76-35fx

Score

5.7

/10

Last Scanned on 2025-05-19

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to next-auth

Other packages similar to next-auth

next-auth

Installations

Developer Guide

Yes

CommonJS, ESM

20.8.0

10.1.0

Score

Pull Requests

137

3,219

878

2,204

Issues

347

4,915

4,568

Releases

Languages

Developer

Download Statistics

GitHub Statistics

Bundle Size

283.91 kB

82.78 kB

Maintainers

Package Meta Information

Total Downloads

114,695,883

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

Peer Dependencies

Dev Dependencies

NextAuth.js

Overview

Getting Started

Features

Flexible and easy to use

Own your own data

Secure by default

TypeScript

Example

Add API Route

Add React Hook

Share/configure session state

Security

Acknowledgments

Support

Contributing

License

10

10

10

10

10

9

6

0

0

0

0

0

5.7

/10