NextAuth credentials not saving in state

user_15189216 0
Viewed 217

Im using nextAuth with my own database of users (mongoDb) and i want the person to be able to sign in with their credentials. The problem is my user object is not being persisted in state, This seems to be a design choice by the people at nextAuth to discourage usernames and passwords, They have said:

If you use a custom credentials provider user accounts will not be 
persisted in a database by NextAuth.js (even if one is configured)

This seems like a massive hinderance.... I currently doing this to get past it and am wondering what the downside is here:

 async authorize(credentials) {

        // check if the user exists in the database
        let user = await db.collection('users').findOne({username:credentials.username})

        if (user && user.password == credentials.password) {
          // return the user object returned from the database
          // because next auth will not save this is state
          return {name: {user}}
        } else {
          return {name: null, email: null, image: null}
        }
      }
next-auth next.js reactjs
1 Answers

The downside is that you will have to manage the security aspects of saving passwords in databases yourself.

We usually recommend third-party providers who have battle-tested systems for keeping your passwords secure. If you are fine with rolling your own solution, there is nothing wrong with it.

As a warning note ⚠, just from your code above, I already see a HUGE security problem. You seem to store passwords as plain text in your database. If your db ever gets leaked, ALL your user's accounts will be available to the hacker immediately.

user_53641350
Related