Seeking Assistance with Security Vulnerabilities in Next.js Project Using NextAuth

[beheraBi]

Hi Team,

I hope you're doing well. I'm reaching out because I've encountered some high security vulnerabilities in my Next.js project, specifically related to NextAuth. Here are the details:

Next.js Version: ^13.4.12
NextAuth Version: ^4.10.3
Upon scanning my application with ZAP scanner, I've identified a couple of high-security vulnerabilities. Following are the details:

Name Risk Level Number of Instances
None Hashing Algorithm Attack High 3
Path Traversal High 1

Name: Path Traversal
URL: https://localhost:3000/api/auth/signin/keycloak
Method: POST
Attack: /keycloak
Instances: 1

Name: None Hashing Algorithm Attack
URL: https://localhost:3000/?auth_callback=1&state=d86b66b6-b8c8-4639-b98f-e207dab40d11&session_sta
Method: GET
Attack: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJleHAiOjE3MTUwNzI0MjQsImlhdCI6MTcxNTA2ODgyNCwiYXV0aF90aW1lIjoxNzE1MDY4OD

I believe they might be related to how I've implemented NextAuth in my project. Below, I've provided the relevant code snippets for [...nextauth].ts and middleware:

[...nextauth].ts:

export const authOptions: any = {
  providers: [
    KeycloakProvider({
      clientId: `${process.env.KEYCLOAK_ID}`,
      clientSecret: `${process.env.KEYCLOAK_SECRET}`,
      issuer: process.env.KEYCLOAK_ISSUER,
    }),
  ],
  theme: {
    colorScheme: 'light',
  },
  session: {
    strategy: 'jwt',
    maxAge: 10 * 60,
  },
  events: {
    async signOut({ token }: DataInterface) {
      return handleSignOut(token);
    },
  },
  pages: {
    signIn: `/auth/signin`,
  },
  callbacks: {
    async jwt({ token, user, account, profile }: DataInterface) {
      if (account && user) {
        const rolesPermissions = extractRolesAndPermissions(
          account.access_token
        );
        const userWithRolesPermissions: any = { ...user, ...rolesPermissions };

        return {
          accessToken: account.access_token,
          accessTokenExpires: Date.now() + 5 * 60 * 1000,
          refreshToken: account.refresh_token,
          idToken: account.id_token,
          orgName: profile.orgName,
          user: userWithRolesPermissions,
        };
      }
      if (Date.now() < token.accessTokenExpires) {
        return token;
      }
      return refreshAccessToken(token);
    },
    async session({ session, token }: DataInterface) {
      session.user = token.user;
      session.accessToken = token.accessToken;
      session.error = token.error;
      session.refreshToken = token.refreshToken;
      session.idToken = token.idToken;
      session.accessTokenExpires = token.accessTokenExpires;
      session.orgName = token.orgName;

      return session;
    },
  },
};

export default NextAuth(authOptions);

middleware.ts:

import { withAuth } from "next-auth/middleware";
export default withAuth({
  pages: {
    signIn: "/auth/signin",
  },
});
export const config = {
  matcher: ["/((?!api|_next/static|_next/image|favicon.ico).*)"],
}

I'm seeking guidance on how to address these vulnerabilities and ensure the security of my Next.js application using NextAuth. Any insights, best practices, or suggestions you can provide would be greatly appreciated.

Thank you in advance for your help!

Best Regards,
Biswajit