{"record":{"id":"6c0c1404b8115283","repo":"nextauthjs/next-auth","slug":"csrf-disabled","errorCode":"csrf-disabled","errorMessage":"csrf-disabled","messagePattern":"csrf-disabled","errorType":"error_code","errorClass":null,"httpStatus":404,"severity":"warning","filePath":"packages/core/src/lib/pages/index.ts","lineNumber":69,"sourceCode":" */\nexport default function renderPage(params: RenderPageParams) {\n  const { url, theme, query, cookies, pages, providers } = params\n\n  return {\n    csrf(skip: boolean, options: InternalOptions, cookies: Cookie[]) {\n      if (!skip) {\n        return {\n          headers: {\n            \"Content-Type\": \"application/json\",\n            \"Cache-Control\": \"private, no-cache, no-store\",\n            Expires: \"0\",\n            Pragma: \"no-cache\",\n          },\n          body: { csrfToken: options.csrfToken },\n          cookies,\n        }\n      }\n      options.logger.warn(\"csrf-disabled\")\n      cookies.push({\n        name: options.cookies.csrfToken.name,\n        value: \"\",\n        options: { ...options.cookies.csrfToken.options, maxAge: 0 },\n      })\n      return { status: 404, cookies }\n    },\n    providers(providers: InternalProvider[]) {\n      return {\n        headers: { \"Content-Type\": \"application/json\" },\n        body: providers.reduce<Record<string, PublicProvider>>(\n          (acc, { id, name, type, signinUrl, callbackUrl }) => {\n            acc[id] = { id, name, type, signinUrl, callbackUrl }\n            return acc\n          },\n          {}\n        ),\n      }","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/pages/index.ts#L51-L87","documentation":"This warning is emitted by Auth.js when CSRF protection is disabled (options.csrfToken is falsy). The csrf() helper clears any existing csrfToken cookie (maxAge 0) and returns a 404 response because CSRF-protected routes cannot operate without a token. It is a warn-level signal, not a thrown exception, that the CSRF layer has been intentionally or accidentally turned off.","triggerScenarios":"Calling AuthInternal's csrf() flow when options.csrfToken is not defined/undefined — typically because the AuthConfig was created without a csrfToken in options or with CSRF disabled; any request that hits the CSRF token endpoint then logs the warning and gets 404 with an expired csrfToken cookie.","commonSituations":"Custom auth route setups that strip the csrfToken from options; hosting/edge middleware dropping cookies; misconfigured cookie store in serverless deployments; users intentionally disabling CSRF behind an API gateway and then wondering why /csrf 404s.","solutions":["Restore CSRF protection: ensure options.csrfToken (and cookies.csrfToken) are present in the config passed to Auth()","If CSRF is intentionally disabled, serve tokens through your own layer instead of calling the built-in csrf() route","Check middleware/proxy configuration so the csrfToken cookie is not stripped between client and server","If only the warning is bothersome, configure logger.warn to filter out 'csrf-disabled'"],"exampleFix":"// before\nexport const { GET, POST } = NextAuth({ providers, csrfToken: undefined })\n// after\nexport const { GET, POST } = NextAuth({ providers, cookies, csrfToken: options.csrfToken })","handlingStrategy":"validation","validationCode":"if (!options?.csrfToken) {\n  console.warn('CSRF token missing in Auth.js options — csrf routes will 404')\n}","typeGuard":"function hasCsrfToken(o: unknown): o is { csrfToken: { name: string; options: object } } {\n  return typeof o === 'object' && o !== null && 'csrfToken' in o\n}","tryCatchPattern":null,"preventionTips":["Never strip csrfToken from the Auth.js options object","Keep the default cookies config intact so cookies.csrfToken always exists","Test the /api/auth/csrf endpoint in your integration tests","If disabling CSRF intentionally, document it and bypass the built-in csrf route"],"tags":["authjs","csrf","configuration","cookies"],"backgroundTag":"csrf-disabled","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}