{"record":{"id":"c9dc69a7e3ccb8f9","repo":"nextauthjs/next-auth","slug":"env-url-basepath-redundant","errorCode":"env-url-basepath-redundant","errorMessage":"env-url-basepath-redundant","messagePattern":"env-url-basepath-redundant","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/core/src/lib/utils/env.ts","lineNumber":20,"sourceCode":"import type { AuthConfig } from \"../../index.js\"\nimport { setLogger } from \"./logger.js\"\n\n/**\n *  Set default env variables on the config object\n * @param suppressWarnings intended for framework authors.\n */\nexport function setEnvDefaults(\n  envObject: any,\n  config: AuthConfig,\n  suppressBasePathWarning = false\n) {\n  try {\n    const url = envObject.AUTH_URL\n    if (url) {\n      if (config.basePath) {\n        if (!suppressBasePathWarning) {\n          const logger = setLogger(config)\n          logger.warn(\"env-url-basepath-redundant\")\n        }\n      } else {\n        config.basePath = new URL(url).pathname\n      }\n    }\n  } catch {\n    // Catching and swallowing potential URL parsing errors, we'll fall\n    // back to `/auth` below.\n  } finally {\n    config.basePath ??= `/auth`\n  }\n\n  if (!config.secret?.length) {\n    config.secret = []\n    const secret = envObject.AUTH_SECRET\n    if (secret) config.secret.push(secret)\n    for (const i of [1, 2, 3]) {\n      const secret = envObject[`AUTH_SECRET_${i}`]","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/utils/env.ts#L2-L38","documentation":"setEnvDefaults derives basePath from AUTH_URL's pathname when config.basePath is unset. If you ALSO set config.basePath manually while AUTH_URL already contains a path, the two sources conflict, so the library logs this warning and keeps the explicit basePath. It means your AUTH_URL pathname is redundant and may diverge from the actual route prefix.","triggerScenarios":"Calling setEnvDefaults with envObject.AUTH_URL set (e.g. AUTH_URL=https://app.example.com/auth/v1) while config.basePath is also non-empty (e.g. basePath: '/api/auth').","commonSituations":"Copying deployment URLs that already include the auth path into AUTH_URL while keeping basePath in config; migrating from AUTH_URL-only setups to explicit basePath; environment templates where staging URLs include a subpath.","solutions":["Remove the path portion from AUTH_URL (use origin only, e.g. https://app.example.com) and keep config.basePath","Or remove config.basePath and let setEnvDefaults derive it from AUTH_URL's pathname","Keep AUTH_URL and basePath in sync across environments (build-time vs runtime) so they never disagree"],"exampleFix":"// before\nAUTH_URL=https://app.example.com/api/auth\nbasePath: '/api/auth'\n// after\nAUTH_URL=https://app.example.com\nbasePath: '/api/auth'","handlingStrategy":"validation","validationCode":"const url = new URL(process.env.AUTH_URL)\nif (config.basePath && url.pathname !== '/' && url.pathname !== config.basePath) {\n  console.warn('AUTH_URL contains a redundant basePath')\n}","typeGuard":"function authUrlPathIsRoot(u: string): boolean {\n  try { return new URL(u).pathname === '/' } catch { return false }\n}","tryCatchPattern":null,"preventionTips":["Store AUTH_URL as origin-only; keep route prefixes solely in basePath","Per-environment env checklist verifying AUTH_URL vs basePath agreement","Fail fast in CI with a script comparing AUTH_URL pathname and basePath","Wrap setLogger to surface warn codes as build errors in non-production"],"tags":["authjs","env","configuration","basepath"],"backgroundTag":"env-url-basepath-redundant","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}