nextauthjs/next-auth · warning

csrf-disabled

csrf-disabled

Error message

csrf-disabled

What it means

This warning is emitted by Auth.js when CSRF protection is disabled (options.csrfToken is falsy). The csrf() helper clears any existing csrfToken cookie (maxAge 0) and returns a 404 response because CSRF-protected routes cannot operate without a token. It is a warn-level signal, not a thrown exception, that the CSRF layer has been intentionally or accidentally turned off.

Source

Thrown at packages/core/src/lib/pages/index.ts:69

 */
export default function renderPage(params: RenderPageParams) {
  const { url, theme, query, cookies, pages, providers } = params

  return {
    csrf(skip: boolean, options: InternalOptions, cookies: Cookie[]) {
      if (!skip) {
        return {
          headers: {
            "Content-Type": "application/json",
            "Cache-Control": "private, no-cache, no-store",
            Expires: "0",
            Pragma: "no-cache",
          },
          body: { csrfToken: options.csrfToken },
          cookies,
        }
      }
      options.logger.warn("csrf-disabled")
      cookies.push({
        name: options.cookies.csrfToken.name,
        value: "",
        options: { ...options.cookies.csrfToken.options, maxAge: 0 },
      })
      return { status: 404, cookies }
    },
    providers(providers: InternalProvider[]) {
      return {
        headers: { "Content-Type": "application/json" },
        body: providers.reduce<Record<string, PublicProvider>>(
          (acc, { id, name, type, signinUrl, callbackUrl }) => {
            acc[id] = { id, name, type, signinUrl, callbackUrl }
            return acc
          },
          {}
        ),
      }

View on GitHub (pinned to a1a16a5a77)

Solutions

1. Restore CSRF protection: ensure options.csrfToken (and cookies.csrfToken) are present in the config passed to Auth()
2. If CSRF is intentionally disabled, serve tokens through your own layer instead of calling the built-in csrf() route
3. Check middleware/proxy configuration so the csrfToken cookie is not stripped between client and server
4. If only the warning is bothersome, configure logger.warn to filter out 'csrf-disabled'

Example fix

// before
export const { GET, POST } = NextAuth({ providers, csrfToken: undefined })
// after
export const { GET, POST } = NextAuth({ providers, cookies, csrfToken: options.csrfToken })

if (!options?.csrfToken) {
  console.warn('CSRF token missing in Auth.js options — csrf routes will 404')
}

function hasCsrfToken(o: unknown): o is { csrfToken: { name: string; options: object } } {
  return typeof o === 'object' && o !== null && 'csrfToken' in o
}

When it happens

Trigger: Calling AuthInternal's csrf() flow when options.csrfToken is not defined/undefined — typically because the AuthConfig was created without a csrfToken in options or with CSRF disabled; any request that hits the CSRF token endpoint then logs the warning and gets 404 with an expired csrfToken cookie.

Common situations: Custom auth route setups that strip the csrfToken from options; hosting/edge middleware dropping cookies; misconfigured cookie store in serverless deployments; users intentionally disabling CSRF behind an API gateway and then wondering why /csrf 404s.

Related errors

• ${name} cookie was missing
• CSRF token was missing during an action ${action}
• env-url-basepath-redundant
• env-url-basepath-mismatch
• Dgraph client error: Please provide an API key

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/6c0c1404b8115283. Report an issue: GitHub.