v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.nextauth.authorized-always-true

The NextAuth/Auth.js authorized callback returns true unconditionally.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This callback is the gate the middleware uses to protect routes, so returning a constant true authorizes every request and disables the protection entirely. Check the session instead, for example authorized: ({ auth }) => !!auth?.user, and return false (or a Response.redirect to your login page) when there is no signed-in user.

VULNERABLE
vulnerable.ts
import NextAuth from 'next-auth';
import type { NextAuthConfig } from 'next-auth';

export const authConfig: NextAuthConfig = {
  providers: [],
  callbacks: {
    // ruleid: auth.nextauth.authorized-always-true
    authorized({ auth }) {
      return true;
    },
  },
};

export const { auth } = NextAuth({
  providers: [],
  callbacks: {
    // ruleid: auth.nextauth.authorized-always-true
    authorized: ({ auth }) => true,
  },
});

export const authOptions = {
  providers: [],
  callbacks: {
    // ruleid: auth.nextauth.authorized-always-true
    authorized: async ({ request, auth }) => {
      return true;
    },
  },
};
SAFE
safe.ts
import NextAuth from 'next-auth';
import type { NextAuthConfig } from 'next-auth';

export const authConfig: NextAuthConfig = {
  providers: [],
  callbacks: {
    // ok: auth.nextauth.authorized-always-true -- checks the session
    authorized({ auth }) {
      return !!auth?.user;
    },
  },
};

export const { auth } = NextAuth({
  providers: [],
  callbacks: {
    // ok: auth.nextauth.authorized-always-true -- gates public vs protected routes
    authorized: ({ auth, request }) => {
      const isLoggedIn = !!auth?.user;
      if (request.nextUrl.pathname.startsWith('/dashboard')) return isLoggedIn;
      return true;
    },
  },
});

// ok: auth.nextauth.authorized-always-true -- unrelated object, not a NextAuth config
const acl = {
  callbacks: {
    authorized: () => true,
  },
};

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.nextauth.authorized-always-true -- <reason>

References

https://authjs.dev/reference/nextjs#authorized ↗https://cwe.mitre.org/data/definitions/862.html ↗