Infinite _rsc= query param requests when using withAuth middleware with Next.js 13 app dir

[bestickley]

Hi, I have the following middleware.ts file:

import { withAuth } from "next-auth/middleware";

export default withAuth({
  pages: {
    signIn: "/login",
  },
});

export const config = {
  /**
   * Match all request paths except for the ones starting with:
   * - login
   * - _next/static
   * - _next/image
   * - favicon.ico
   */
  matcher: ["/((?!login|_next/static|_next/image|favicon.ico).*)"],
};

and it result in infinite fetch requests to http://localhost:3000/my/path?_rsc=2d11594. Does anyone have any idea why this is happening? I've seen a couple of other issues related to infinite redirects, but this has to do with infinite fetches. I thought it had to do with prefetching, but there are no Links on my page. Note, this doesn't happen on my /login page which is excluded from middleware.

[bestickley]

UPDATE: this looks to be an issue with Turbopack as when I use webpack, no issue arises. Leaving here for others to see.

[rjnls]

I'm having this same problem and I have not been able to solve it. In my case whatever is in the callbackUrl is getting hit with a ?_rsc= request resulting in infinite recursive redirects. Everything works fine so long as I navigate directly to the login page, but if I go to a different page without being authenticated and I get redirected to the login page with a callbackUrl set in the query string, then all heck breaks loose. I hadn't realized it was happening, you only can tell if you look at the network tab, but when I recently implemented middleware logging I discovered this monstrosity.

What's worse is it's stripping the _rsc portion off of the request so I can't even detect it or match it! It really seems like a bug that nobody has noticed because it's invisible unless you are looking closely. It shouldn't be prefetching pages if it's not authenticated yet!