NextAuth中callbacks.authorized回调始终无法触发求助

我基于NextAuthConfig配置了NextAuth v5，但callbacks.authorized回调完全没触发。官方文档提到这个回调和middleware有关，但我没搞明白其中的依赖关系，求解决思路。

配置代码 #

const authOptions: NextAuthConfig = {
    trustHost: true,
    session: {
        strategy: 'jwt',
    },
    providers: [
        CredentialsProvider({
            id: 'mycompany',
            name: 'mycompany',
            type: 'credentials',
            authorize: authorize as any,
            credentials: {
                email: { label: 'Email', type: 'text', placeholder: 'email@provider.com' },
                password: { label: 'Password', type: 'password' },
            },
        }) as any,
    ],
    pages: {
        signIn: '/auth/signin',
    },
    callbacks: {
        async authorized({ auth, request: { nextUrl } }) {
            throw new Error('this never happens')
        },
        redirect: ({ baseUrl, url }: any) => {
            // 省略（正常工作）
        },
        async jwt({ token, ...params }: any) {
            // 省略（正常工作）
        },
        async session({ session, ...params }: any) {
            // 省略（正常工作）
        },
    }
}

export default authOptions
async function authorize(credentials?: { email?: string; password?: string }) {
 // 省略（正常工作）
}

当前middleware代码 #

import { getSubdomainFromHost } from '@mycompany/shared/helpers/url';
import { NextResponse, type NextFetchEvent, type NextRequest } from 'next/server';
import { getLogger } from './lib/getLogger';

const logger = getLogger()

// export const config = {
//  matcher: [
//    /*
//     * Match all request paths except for the ones starting with:
//     * - api (API routes)
//     * - _next/static (static files)
//     * - _next/image (image optimization files)
//     * - favicon.ico (favicon file)
//     */
//    {
//      source: '/((?!_next/static|_next/image|favicon.ico|icons|logo).*)',
//      missing: [
//        { type: 'header', key: 'next-router-prefetch' },
//        { type: 'header', key: 'purpose', value: 'prefetch' },
//      ],
//    },
//  ],
// }

export function middleware(request: NextRequest, _next: NextFetchEvent) {
    const headers = new Headers(request.headers)
    headers.set('x-forwarded', request.url)
    headers.set('x-base-url', `${request.nextUrl.protocol}://${request.nextUrl.host}`)
    const host = request.headers.get('host')
    const subdomain = getSubdomainFromHost(host)
    if(subdomain) {
        headers.set('x-subdomain', subdomain)
    }

    logger.debug(`[Middleware] NextResponse.next: `, request.url)
    return NextResponse.next({
        request: {
            headers,
        },
    })
}

依赖版本 #

"next": "14.2.3",
"next-auth": "5.0.0-beta.17",

核心原因 #

NextAuth v5的authorized回调必须依赖Auth.js自带的middleware才能触发。你当前的middleware是完全自定义的独立逻辑，没有集成Auth.js的认证中间件，权限校验流程根本没启动，authorized自然不会被调用。

具体修复步骤 #

1. 集成Auth.js的auth middleware
   在middleware.ts中导入Auth.js生成的auth函数，用它包裹自定义的middleware逻辑，让认证流程接管权限校验。

2. 恢复并启用路径匹配规则
   取消注释config.matcher，确保它覆盖需要校验的路径，同时排除静态资源、图标等无需认证的路径，避免不必要的校验。

3. 调整middleware执行逻辑
   自定义的header处理逻辑可以保留，但要放在Auth.js的auth流程中执行，确保认证头不会被覆盖。

修改后的middleware代码 #

import { getSubdomainFromHost } from '@mycompany/shared/helpers/url';
import { NextResponse, type NextRequest } from 'next/server';
import { getLogger } from './lib/getLogger';
// 导入Auth.js生成的auth函数，路径要和你的auth配置文件对应
import { auth } from '@/auth';

const logger = getLogger()

// 启用路径匹配规则
export const config = {
  matcher: [
    /*
     * 匹配所有请求路径，除了以下开头的：
     * - api (API路由)
     * - _next/static (静态文件)
     * - _next/image (图片优化文件)
     * - favicon.ico (图标文件)
     */
    {
      source: '/((?!_next/static|_next/image|favicon.ico|icons|logo).*)',
      missing: [
        { type: 'header', key: 'next-router-prefetch' },
        { type: 'header', key: 'purpose', value: 'prefetch' },
      ],
    },
  ],
}

// 用Auth.js的auth包裹自定义middleware逻辑
export default auth(async function middleware(request: NextRequest) {
    const headers = new Headers(request.headers)
    headers.set('x-forwarded', request.url)
    headers.set('x-base-url', `${request.nextUrl.protocol}://${request.nextUrl.host}`)
    
    const host = request.headers.get('host')
    const subdomain = getSubdomainFromHost(host)
    if(subdomain) {
        headers.set('x-subdomain', subdomain)
    }

    logger.debug(`[Middleware] NextResponse.next: `, request.url)
    return NextResponse.next({
        request: {
            headers,
        },
    })
})

补充说明 #

• 确保你的auth配置入口文件（比如auth.ts）正确导出auth函数，示例如下：

import NextAuth from "next-auth"
import authOptions from "./auth-options" // 你的配置文件路径

export const { auth, handlers, signIn, signOut } = NextAuth(authOptions)

• authorized回调会在Auth.js的middleware处理请求时自动调用，用于判断当前用户是否有权限访问目标路径；如果返回false，会自动跳转到你配置的登录页。

内容的提问来源于stack exchange，提问作者brianc