From e6ad43a76c5a98b1d9674413f21c956e3ab0b54f Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Fri, 28 Aug 2026 12:23:55 -0700
Subject: [PATCH] Tweak: improve nextauth error logging for easier debugging
 (#7070)

---
 src/__tests__/pages/api/auth/[...nextauth].test.js |  3 ++-
 src/pages/api/auth/[...nextauth].js                | 12 +++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/__tests__/pages/api/auth/[...nextauth].test.js b/src/__tests__/pages/api/auth/[...nextauth].test.js
index e963b3b59..05f670f50 100644
--- a/src/__tests__/pages/api/auth/[...nextauth].test.js
+++ b/src/__tests__/pages/api/auth/[...nextauth].test.js
@@ -73,6 +73,7 @@ describe("pages/api/auth/[...nextauth]", () => {
   it("routes sanitized NextAuth logs through the Homepage logger", async () => {
     const mod = await import("pages/api/auth/[...nextauth]");
     const sensitiveMetadata = {
+      error: Object.assign(new Error("State cookie was missing."), { access_token: "sensitive-access-token" }),
       clientSecret: "sensitive-client-secret",
       access_token: "sensitive-access-token",
       id_token: "sensitive-id-token",
@@ -82,7 +83,7 @@ describe("pages/api/auth/[...nextauth]", () => {
     mod.authOptions.logger.warn("NEXTAUTH_URL", sensitiveMetadata);
     mod.authOptions.logger.debug("OAUTH_CALLBACK_RESPONSE", sensitiveMetadata);
 
-    expect(errorMock).toHaveBeenCalledWith("%s", "OAUTH_CALLBACK_ERROR");
+    expect(errorMock).toHaveBeenCalledWith("%s: %s", "OAUTH_CALLBACK_ERROR", "State cookie was missing.");
     expect(warnMock).toHaveBeenCalledWith("%s", "NEXTAUTH_URL");
     expect(debugMock).toHaveBeenCalledWith("%s", "OAUTH_CALLBACK_RESPONSE");
     expect(JSON.stringify([...errorMock.mock.calls, ...warnMock.mock.calls, ...debugMock.mock.calls])).not.toContain(
diff --git a/src/pages/api/auth/[...nextauth].js b/src/pages/api/auth/[...nextauth].js
index ce5a9f505..5379f8bbd 100644
--- a/src/pages/api/auth/[...nextauth].js
+++ b/src/pages/api/auth/[...nextauth].js
@@ -71,6 +71,16 @@ function logFailedPasswordSignIn() {
   createLogger("nextauth").warn("Failed password sign-in attempt");
 }
 
+function logNextAuthError(code, metadata) {
+  const error = metadata instanceof Error ? metadata : metadata?.error;
+
+  if (error?.message) {
+    createLogger("nextauth").error("%s: %s", code, error.message);
+  } else {
+    createLogger("nextauth").error("%s", code);
+  }
+}
+
 let providers = [];
 if (authEnabled) {
   if (hasOidcConfig) {
@@ -140,7 +150,7 @@ export const authOptions = {
     signIn: "/auth/signin",
   },
   logger: {
-    error: (code) => createLogger("nextauth").error("%s", code),
+    error: logNextAuthError,
     warn: (code) => createLogger("nextauth").warn("%s", code),
     debug: (code) => createLogger("nextauth").debug("%s", code),
   },