fix(webauthn): update base URL construction for authentication flows

[sillvva]

☕️ Reasoning

In setEnvDefaults(env, _config), config.basePath is being fixed to this specific value.

next-auth/packages/frameworks-sveltekit/src/lib/env.ts

Line 11 in 3281854

config.basePath = `${base}/auth`

In webauthn.ts, the /auth has been excluded from the path causing the webauthn flow to break.

next-auth/packages/frameworks-sveltekit/src/lib/webauthn.ts

Lines 27 to 34 in 3281854

	const baseUrl = base ?? ""
	// @ts-expect-error
	const params = new URLSearchParams(options)
	const optionsResp = await fetch(
	`${baseUrl}/webauthn-options/${providerID}?${params}`
	)

In the meantime, I've added this extra hook in my codebase to temporarily fix the issue

const webAuthnRedirect: Handle = async ({ event, resolve }) => {
	if (event.url.pathname.startsWith("/webauthn-options")) {
		event.url.pathname = event.url.pathname.replace("/webauthn-options", "/auth/webauthn-options");
		return new Response(null, {
			status: 302,
			headers: {
				Location: event.url.toString()
			}
		});
	}

	if (event.url.pathname.startsWith("/callback/webauthn")) {
		event.url.pathname = event.url.pathname.replace("/callback/webauthn", "/auth/callback/webauthn");
		return new Response(null, {
			status: 302,
			headers: {
				Location: event.url.toString()
			}
		});
	}

	return await resolve(event);
};

export const handle = sequence(webAuthnRedirect, auth.handle, ...);

🧢 Checklist

• Documentation
• Tests
• Ready to be merged

🎫 Affected issues

📌 Resources

• Security guidelines
• Contributing guidelines
• Code of conduct
• Contributing to Open Source

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
auth-docs	❌ Failed (Inspect)			Jul 1, 2025 7:59pm

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
next-auth-docs	⬜️ Ignored (Inspect)	Visit Preview		Jul 1, 2025 7:59pm

[vercel]

@sillvva is attempting to deploy a commit to the authjs Team on Vercel.

A member of the Team first needs to authorize it.

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.

Project coverage is 38.76%. Comparing base (3281854) to head (7aa73fd).

Files with missing lines	Patch %	Lines
packages/frameworks-sveltekit/src/lib/webauthn.ts	0.00%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #13081   +/-   ##
=======================================
  Coverage   38.76%   38.76%           
=======================================
  Files         200      200           
  Lines       32322    32322           
  Branches     1399     1399           
=======================================
  Hits        12529    12529           
  Misses      19793    19793           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.