SvelteKit: node-adapter with prerendering will throw UntrustedHost error

[xmlking]

I was building SvelteKit app that has some prerendering routes using node-adapter and faced this error.

Wanted to share my workaround in case someone faces this issue:
I basically added AUTH_TRUST_HOST=http://sveltekit-prerender env to my script

Workaround

	"scripts": {
		"dev": "vite dev",
		"dev:debug": "DEBUG=* vite dev",
		"build": "vite build",
		"build:node": "ADAPTER=node AUTH_TRUST_HOST=http://sveltekit-prerender vite build",
		"build:static": "ADAPTER=static AUTH_TRUST_HOST=http://sveltekit-prerender vite build",
		"preview": "NEXTAUTH_URL=http://localhost:4173 AUTH_TRUST_HOST=http://localhost:4173 vite preview",
		"test": "vitest",
		"test:ui": "vitest --ui",
		"test:coverage": "vitest run --coverage",
		"test:e2e": "playwright test",
		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
		"lint": "prettier --check . && eslint .",
		"format": "prettier --write .",
		"preinstall": "npx only-allow pnpm"
	},

Error Log

UntrustedHost: Host must be trusted. URL was: http://sveltekit-prerender/api/auth/session
    at assertConfig (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/node_modules/.pnpm/@auth+core@0.2.3/node_modules/@auth/core/lib/assert.js:22:16)
    at Auth (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/node_modules/.pnpm/@auth+core@0.2.3/node_modules/@auth/core/index.js:65:29)
    at async getSession (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/.svelte-kit/output/server/chunks/hooks.server.js:3065:20)
    at async guard (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/.svelte-kit/output/server/chunks/hooks.server.js:3171:7)
    at async respond (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/.svelte-kit/output/server/chunks/index.js:2465:22)
    at async visit (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/node_modules/.pnpm/@sveltejs+kit@1.0.1_svelte@3.55.0+vite@4.0.3/node_modules/@sveltejs/kit/src/core/prerender/prerender.js:190:20)

[auth][error][UntrustedHost]: Read more at https://errors.authjs.dev#untrustedhost
Error: There was a problem with the server configuration. Check the server logs for more information.
    at getSession (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/.svelte-kit/output/server/chunks/hooks.server.js:3072:9)
    at async guard (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/.svelte-kit/output/server/chunks/hooks.server.js:3171:7)
    at async respond (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/.svelte-kit/output/server/chunks/index.js:2465:22)
    at async visit (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/node_modules/.pnpm/@sveltejs+kit@1.0.1_svelte@3.55.0+vite@4.0.3/node_modules/@sveltejs/kit/src/core/prerender/prerender.js:190:20)
file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/node_modules/.pnpm/@sveltejs+kit@1.0.1_svelte@3.55.0+vite@4.0.3/node_modules/@sveltejs/kit/src/core/prerender/prerender.js:36
                                throw new Error(format(details));
                                      ^

Error: 500 /
    at file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/node_modules/.pnpm/@sveltejs+kit@1.0.1_svelte@3.55.0+vite@4.0.3/node_modules/@sveltejs/kit/src/core/prerender/prerender.js:36:11
    at save (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/node_modules/.pnpm/@sveltejs+kit@1.0.1_svelte@3.55.0+vite@4.0.3/node_modules/@sveltejs/kit/src/core/prerender/prerender.js:349:4)
    at visit (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/node_modules/.pnpm/@sveltejs+kit@1.0.1_svelte@3.55.0+vite@4.0.3/node_modules/@sveltejs/kit/src/core/prerender/prerender.js:199:3)

Node.js v19.3.0
[vite-plugin-sveltekit-compile] Prerendering failed with code 1

PWA v0.14.0
mode      generateSW
precache  261 entries (4485.96 KiB)
files generated
  .svelte-kit/output/client/sw.js
  .svelte-kit/output/client/workbox-e0782b83.js
warnings
  One of the glob patterns doesn't match any files. Please remove or fix the following: {
  "globDirectory": ".svelte-kit/output",
  "globPattern": "prerendered/**/*.html",
  "globIgnores": [
    "**/node_modules/**/*",
    "client/sw.js",
    "client/workbox-*.js"
  ]
}

error during build:
Error: Prerendering failed with code 1
    at ChildProcess.<anonymous> (file:///Users/schintha/Developer/Work/SPA/svelte-starter-kit/node_modules/.pnpm/@sveltejs+kit@1.0.1_svelte@3.55.0+vite@4.0.3/node_modules/@sveltejs/kit/src/exports/vite/index.js:551:15)
    at ChildProcess.emit (node:events:513:28)
    at ChildProcess._handle.onexit (node:internal/child_process:293:12)
 ELIFECYCLE  Command failed with exit code 1.

I think this error is caused by below handlers used in hooks.server.ts
this caused the build process to prerender /api/auth/session route, which looks like a bug in sveltekit sveltejs/kit#6325

/**
 * Protect the route
 */
import { building } from '$app/environment';
import { Logger } from '$lib/utils';
import { redirect, type Handle } from '@sveltejs/kit';

export const guard = (async ({ event, resolve }) => {
	// skip auth logic on build to prevent infinite redirection in production mode
	// FIXME: https://github.com/nextauthjs/next-auth/discussions/6186
	if (building) return await resolve(event);

	const { locals } = event;
	// TODO:
	// check if user present
	// get user roles
	// check if role has access to target route

	const { user, roles } = (await locals.getSession()) ?? {};
	log.debug('guard:locals.user', user);

	if (event.url.pathname.startsWith('/dashboard')) {
		if (!user) {
			// FIXME: redirect from middleware may cause recursion
			throw redirect(303, `${event.url.origin}/auth/signin?callbackUrl=/dashboard`);
		}
		if (event.url.pathname.startsWith('/dashboard/admin')) {
			if (!roles?.includes('Policy.Write')) {
				throw redirect(303, `${event.url.origin}/dashboard`);
			}
		}
	}
	const response = await resolve(event);
	return response;
}) satisfies Handle;

[tedsteen]

I think AUTH_TRUST_HOST is supposed to be a boolean

[xmlking]

if anyone faces the login page redirect to http://sveltekit-prerender/ after building with pnpm build then preview with pnpm preview
That is caused because I have a link like the one below, which was crawled during build process, and a static /auth/signin/html was generated with the wrong URL

The solution is to add rel="external" to the link to tell SvelteKit build command not to crawl specific URLs

[rbozan]

Shouldn't this library handle this with something like prerender = false in the auth directory?