Missing information for UNTRUST_HOST_ERROR server error

[davidlag0]

What is the improvement or update you wish to see?

I'm expecting the information shown at https://authjs.dev/reference/errors to provide information about how to fix the UNTRUST_HOST_ERROR because this is where we are pointed to by the error message (actually, the link with 4.18.0 is https://next-auth.js.org/errors#untrust_host_error but considering the name change to Auth.js, I'm expecting the new site to show the information)

Is there any context that might help us understand?

Yes, here is the error message I get with version 4.18.0 that makes it impossible for me to upgrade to 4.18.6:

Error: [next-auth][error][UNTRUST_HOST_ERROR] 
https://next-auth.js.org/errors#untrust_host_error Host must be trusted. URL was: https://localhost:3000/api/auth/session UntrustedHost: Host must be trusted. URL was: https://localhost:3000/api/auth/session
    at AuthHandler (/home/runner/work/todo-nextjs/todo-nextjs/node_modules/next-auth/core/index.js:311:19)
    at NextAuthHandler (/home/runner/work/todo-nextjs/todo-nextjs/node_modules/next-auth/next/index.js:38:48)
    at /home/runner/work/todo-nextjs/todo-nextjs/node_modules/next-auth/next/index.js:46:38
    at Object.apiResolver (/home/runner/work/todo-nextjs/todo-nextjs/node_modules/next/dist/server/api-utils/node.js:366:15)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async NextNodeServer.runApi (/home/runner/work/todo-nextjs/todo-nextjs/node_modules/next/dist/server/next-server.js:481:9)
    at async Object.fn (/home/runner/work/todo-nextjs/todo-nextjs/node_modules/next/dist/server/next-server.js:735:37)
    at async Router.execute (/home/runner/work/todo-nextjs/todo-nextjs/node_modules/next/dist/server/router.js:247:36)
    at async NextNodeServer.run (/home/runner/work/todo-nextjs/todo-nextjs/node_modules/next/dist/server/base-server.js:347:29)
    at async NextNodeServer.handleRequest (/home/runner/work/todo-nextjs/todo-nextjs/node_modules/next/dist/server/base-server.js:285:20) {
  code: 'UNTRUST_HOST_ERROR'
}

Does the docs page already exist? Please link to it.

No response

[theetherGit]

#6071

[davidlag0]

@theetherGit
After further investigation, I realized I was missing the NEXTAUTH_URL environment variable in my production configuration. Could it be possible that not having this env var set also causes the same error message?

[theetherGit]

@theetherGit After further investigation, I realized I was missing the NEXTAUTH_URL environment variable in my production configuration. Could it be possible that not having this env var set also causes the same error message?

Maybe, I'm using sveltekit and i had the same issue so might be the reason is this env variable.

[balazsorban44]

Hi, #6132 (comment) could you test out this version? You should not see this server error anymore. Once it's verified, it will be included in the next release, when the PR is merged!

[balazsorban44]

4.18.7 is out with this fixed.

[davidlag0]

I just had a chance to retest and I confirm the problem does not happen anymore even with NEXTAUTH_URL env var unset.

[sytpb]

[auth][error][UntrustedHost]: Host must be trusted. URL was: http://.....

the same problem , how to fix ?

[Jan-T-Berg]

[auth][error][UntrustedHost]: Host must be trusted. URL was: http://.....

the same problem , how to fix ?

you can set "trustHost: true" on your authConfig

authConfig = {
  trustHost: true,
  trustHostedDomain: true,
  pages: {
    signIn: `/login`,
  },
  callbacks: {}
  ...

export const { auth, signIn, signOut } = NextAuth(authConfig);

that accept other host, not so save but for my small use-case is ok.

[Shtekata]

Jan-T-Berg thanks! Тhis solved my problems

[nisharga]

auth.ts

const config = {
trustHost: true,
}

solve your issue :D

[beaniebag]

Had same issue. The solution I preferred was setting the environment variable AUTH_TRUST_HOST to true

i.e. AUTH_TRUST_HOST=true