NextAuth认证报错：State cookie缺失问题求助

问题背景 #

使用Next.js 14.2.4 + NextAuth 4.24.7实现Discord OAuth2认证时，重定向到/api/auth/callback/[provider]阶段出现如下错误：

[next-auth][error][OAUTH_CALLBACK_ERROR] 
https://next-auth.js.org/errors#oauth_callback_error State cookie was missing. {  
  error: TypeError: State cookie was missing.
      at Object.use (D:\Code\GitHub files\Website-Dashboard\node_modules\next-auth\core\lib\oauth\checks.js:111:23)
      at oAuthCallback (D:\Code\GitHub files\Website-Dashboard\node_modules\next-auth\core\lib\oauth\callback.js:89:25)
      ...（省略后续堆栈信息）
  providerId: 'discord',
  message: 'State cookie was missing.'
}

已尝试设置checks: ['none']绕过CSRF保护，错误消失但会降低安全性，非可行方案；其他环境变量调整和论坛方案均无效。

相关配置代码如下：

import NextAuth from 'next-auth';
import DiscordProvider from 'next-auth/providers/discord';
import jwt from 'jsonwebtoken';

export default NextAuth({
    debug: true,
    providers: [
        DiscordProvider({
            clientId: process.env.DISCORD_CLIENT_ID || "",
            clientSecret: process.env.DISCORD_CLIENT_SECRET || "",
            authorization: { params: { scope: 'identify' } }
        }),
    ],
    secret: process.env.NEXTAUTH_SECRET,
    cookies: {
        sessionToken: {
            name: `__Secure-next-auth.session-token`,
            options: {
                httpOnly: true,
                sameSite: 'lax',
                path: '/',
                secure: process.env.NODE_ENV === 'production',
                domain: process.env.NODE_ENV === 'production' ? 'domain.com' : undefined
            }
        }
    },
    callbacks: {
        async jwt({ token, account, profile }) {
            // 自定义逻辑
            return token;
        },
        async session({ session, token }) {
            const new_token = token as unknown as Haurto_Token_Decoded;
            if (new_token) {
               // 自定义逻辑
            }
            return session;
        },
        async redirect({ url, baseUrl }) {
            if (url.startsWith(baseUrl)) {
                return url;
            }
            return baseUrl;
        }
    },
    pages: {
        signIn: '/',
        signOut: '/',
        error: '/uhh',
    }
});

问题原因 #

自定义了sessionToken的Cookie配置，但未同步配置NextAuth用于OAuth状态校验的state Cookie，导致回调阶段无法读取到正确的State Cookie，触发校验失败。

修复方案 #

在cookies配置中添加state的Cookie规则，保持与sessionToken一致的域名、安全策略等参数，确保Cookie的上下文匹配：

修改后的完整配置代码 #

import NextAuth from 'next-auth';
import DiscordProvider from 'next-auth/providers/discord';
import jwt from 'jsonwebtoken';

export default NextAuth({
    debug: true,
    providers: [
        DiscordProvider({
            clientId: process.env.DISCORD_CLIENT_ID || "",
            clientSecret: process.env.DISCORD_CLIENT_SECRET || "",
            authorization: { params: { scope: 'identify' } }
        }),
    ],
    secret: process.env.NEXTAUTH_SECRET,
    cookies: {
        sessionToken: {
            name: `__Secure-next-auth.session-token`,
            options: {
                httpOnly: true,
                sameSite: 'lax',
                path: '/',
                secure: process.env.NODE_ENV === 'production',
                domain: process.env.NODE_ENV === 'production' ? 'domain.com' : undefined
            }
        },
        // 添加State Cookie配置，与sessionToken参数一致
        state: {
            name: `__Secure-next-auth.state`,
            options: {
                httpOnly: true,
                sameSite: 'lax',
                path: '/',
                secure: process.env.NODE_ENV === 'production',
                domain: process.env.NODE_ENV === 'production' ? 'domain.com' : undefined
            }
        }
    },
    callbacks: {
        async jwt({ token, account, profile }) {
            // 自定义逻辑
            return token;
        },
        async session({ session, token }) {
            const new_token = token as unknown as Haurto_Token_Decoded;
            if (new_token) {
               // 自定义逻辑
            }
            return session;
        },
        async redirect({ url, baseUrl }) {
            if (url.startsWith(baseUrl)) {
                return url;
            }
            return baseUrl;
        }
    },
    pages: {
        signIn: '/',
        signOut: '/',
        error: '/uhh',
    }
});

额外注意事项 #

1. 确保环境变量NEXTAUTH_URL正确设置：开发环境为http://localhost:3000，生产环境为你的实际域名（如https://domain.com）
2. 修改配置后，清除浏览器缓存和所有相关Cookie，重新启动项目测试
3. 生产环境下确保域名配置正确，避免跨域Cookie无法读取的问题

内容的提问来源于stack exchange，提问作者BlackInk7777