Next-auth: Credentials sign in using a custom form

[adriandmitroca]

What are you trying to do
I am trying to authenticate user programmatically (custom form) using signin("credentials", { email: '[email protected]', password: 'secret' }, but it redirects me to /api/auth/signin form instead.

How to trigger actual authentication instead? Does signin return any values based on failure / success?

• [ ] Found the documentation helpful
• [x] Found documentation but was incomplete
• [x] Could not find relevant documentation
• [x] Found the example project helpful
• [ ] Did not find the example project helpful

[nemmtor]

You can handle custom signin form by fetching /api/auth/callback/credentials with POST method, but I didnt find a way to display signin errors on the same page, it will redirect to error page

[iaincollins]

• Sorry, info about how to do this got removed from the documentation (it was outdated and I spotted a problem with it).
• The tip from @nemmtor is good! +1
• The signin() method as you are using it should work, that looks like a legit bug report

There is actually a problem with submitting credentials as I don't think it's enforcing CSRF Tokens on submit, which is not ideal (i.e. it is working even if you don't supply a CSRF token).

If we fix that bug it will "break" HTML forms, but we really should fix it soon (maybe 2.3 or 2.4). I won't do that without updating the examples too though! The change required should be simple.

[iaincollins]

I didnt find a way to display signin errors on the same page, it will redirect to error page

Oh forgot to mention this! The current behaviour isn't ideal, but you can work around it.

If you create a custom error page you can set it to be the same URL as your sign in page and display inline errors on your sign in page by checking the ?error= query parameter.

I want to actually change the internal behaviour in NextAuth.js so that the the built-in pages handle some of the authentication errors in this way as it's a much better user experience.

[iaincollins]

Sign in with credentials using the client methods is working in v3 beta (and is using CSRF tokens on submit).