Server error issue when deployed to Firebase App Hosting Backend

[paulosabayomi]

Hi, I just deployed my next.js app to Firebase App Hosting Backend, and I am getting the following error while trying to signin with Google

I have tried to provide the NEXTAUTH_SECRET to the handler secret: process.env.NEXTAUTH_SECRET, and I have also set NEXTAUTH_URL but the issue persists, this is my handler code

export const { handlers, auth, signIn, signOut } = NextAuth({
    ...authConfig,
    providers: [ 
        Google
    ],
    secret: process.env.NEXTAUTH_SECRET, // the secret set with openssl rand -base64 32
    callbacks: {
        async signIn(params) {            
            if (params.account?.provider == "google") {
                // ... some code
                return true
            }
            return true
        },
        redirect(params) {
            if (params.url.includes('error')) {
                return params.url
            }
            return `${params.baseUrl}/dashboard`
        },
    },
});

and inside my /app/api/auth/[...nextAuth]/route.ts I imported the handler

import { handlers } from "@/auth"
export const { GET, POST } = handlers

this is my auth.config.ts file

import type { NextAuthConfig } from 'next-auth';
 
export const authConfig = {
  pages: {
    signIn: '/signin',
  },
  providers: [],
} satisfies NextAuthConfig;

I have also added the variables inside my apphosting.yaml file to Google Secret Manager and I have granted access to those variables to my App Hosting Backend using the firebase apphosting:secrets:grantaccess VARIABLE_NAME --backend appname command, my apphosting.yaml file looks like this

  - variable: AUTH_SECRET 
    secret: AUTH_SECRET
  
  - variable: NEXTAUTH_SECRET 
    secret: NEXTAUTH_SECRET
  
  - variable: NEXTAUTH_URL 
    secret: NEXTAUTH_URL

everything built successfully when I deployed it to App Hosting Backend and all the variables were built for both BUILD and RUNTIME environments, I have tried so many solutions I found online but none is helpful, please help

[paulosabayomi]

I finally fixed the issue after more than 18 hours of debugging, I used Google Cloud Logging to check the logs in the console and I discovered the issues which is just I didn't set trustHost option to true in the next-auth config and when I did it just worked fine, in case anyone faced the same issue this is how I did it,

First I enabled Google Cloud Logging in the console and then I ran the following command locally, (Mac) while signed in to gcloud locally, to get a list of all the logs of my project, I ran it in the same directory as my project but I am not sure if it is going to work if ran outside of the directory:

gcloud logging logs list

and then I got a list of all the log names of my project including the stderr which is the one that holds the nextauth error, the output was like:

projects/project-id/logs/cloudaudit.googleapis.com%2Factivity
projects/project-id/logs/cloudaudit.googleapis.com%2Fdata_access
projects/project-id/logs/cloudaudit.googleapis.com%2Fsystem_event
projects/project-id/logs/cloudbuild
projects/project-id/logs/run.googleapis.com%2Frequests
projects/project-id/logs/run.googleapis.com%2Fstderr # <---------- this is the one holding the nextjs server errors
projects/project-id/logs/run.googleapis.com%2Fstdout
projects/project-id/logs/run.googleapis.com%2Fvarlog%2Fsystem

and then I ran the following command to read the stderr logs, and that is where I noticed the error

gcloud logging read 'logName=projects/project-id/logs/run.googleapis.com%2Fstderr' --limit 10 --format json

and then as part of the log outputed in json, I saw the error:

...
{
    "insertId": "random-id",
    "labels": {
      "goog-managed-by": "firebase-app-hosting",
      "instanceId": "a-very-long-random-id"
    },
    "logName": "projects/project-id/logs/run.googleapis.com%2Fstderr",
    "receiveTimestamp": "YYYY-MM-DDT09:06:51.638426853Z",
    "resource": {
      "labels": {
        "configuration_name": "app-hosting-project-name",
        "location": "country-code-central1",
        "project_id": "project-id",
        "revision_name": "build-name",
        "service_name": "app-hosting-project-name"
      },
      "type": "cloud_run_revision"
    },
    "textPayload": "\u001b[31m[auth][error]\u001b[0m UntrustedHost: Host must be trusted. URL was: https://customdomain.com/api/auth/session. Read more at https://errors.authjs.dev#untrustedhost",
    "timestamp": "YYYY-MM-DDT09:06:51.333089Z"
  },
...

and going to https://errors.authjs.dev#untrustedhost I saw that trustHost is required to be set, and after I set it this is my code:

import type { NextAuthConfig } from 'next-auth';
 
export const authConfig = {
  pages: {
    signIn: '/signin',
  },
  trustHost: true, // < -------------- this line
  providers: [],
} satisfies NextAuthConfig;

and then I pushed and it rebuilt it again and it worked out of the box