Facebook provider - expected 200 OK, got: 400 Bad Request when creating new users

Provider type

Facebook

Environment

Deployed to Vercel @ Node v14.x
Any browser used, Chrome, Brave, Edge, etc.

npmPackages: next: ^12.1.0 => 12.1.0 next-auth: ^4.2.1 => 4.2.1 react: 17.0.2 => 17.0.2

Reproduction URL

https://github.com/moritzmyrz/next-fb-prov-error-ex

Describe the issue

In production, I am getting this error.

I’ve checked that my Vercel instance is at Node v14.x and that my database is properly configured and migrated with my Prisma schema. It works well with my own account, however, it doesn’t work if one of my friends tries to sign up with Facebook.

[GET] /api/auth/callback/facebook?code=AQCjDd1WazT8DE8SKsstm0e3iOFW10s68xzDOAwk5UNyd1HG-cwh-H5gHNCWBgoAlGIlznyyeJJR4ge588oP_OD262n9e9u1YuO_qcVYu8sPZYGigXeCL1n2ZlFwfQ8EO8x2dtsID_rDjntWpzDbpmtNUki25X9cgbm19h6AC77_HqXwBj8Ublv_y7Dx0yBaovrYqY5FcTv-AqZ1yHNzvy92ZHgv809E7GLJdpxCTux-hXSA5ZKQ22Ru_2W8wFMFaitfwn-4n607O1Y-OxQFf-J_c1Zb_JXEEEpOUM1TLj1aFgYSLlpcOqqwkKfZDkwgvMObubM2_AJfZAF71UodQ9vVWgx1PA8bFT-6G9I_Yyrzjsu9gTIat-8GaF1UPcCHKtI&state=klppdEl9m8SFEYWjPp7UFUbIy-oWawNDgXL3PKv9I-A
21:24:56:43
2022-02-24T20:24:57.173Z	ea894128-a956-40cd-b023-dc791adc17a9	ERROR	[next-auth][error][OAUTH_CALLBACK_ERROR] 
https://next-auth.js.org/errors#oauth_callback_error expected 200 OK, got: 400 Bad Request {
  error: {
    message: 'expected 200 OK, got: 400 Bad Request',
    stack: 'OPError: expected 200 OK, got: 400 Bad Request\n' +
      '    at processResponse (/var/task/node_modules/openid-client/lib/helpers/process_response.js:41:11)\n' +
      '    at Client.grant (/var/task/node_modules/openid-client/lib/client.js:1340:22)\n' +
      '    at processTicksAndRejections (internal/process/task_queues.js:95:5)\n' +
      '    at async Client.oauthCallback (/var/task/node_modules/openid-client/lib/client.js:612:24)\n' +
      '    at async oAuthCallback (/var/task/node_modules/next-auth/core/lib/oauth/callback.js:114:16)\n' +
      '    at async Object.callback (/var/task/node_modules/next-auth/core/routes/callback.js:50:11)\n' +
      '    at async NextAuthHandler (/var/task/node_modules/next-auth/core/index.js:139:28)\n' +
      '    at async NextAuthNextHandler (/var/task/node_modules/next-auth/next/index.js:21:19)\n' +
      '    at async Object.apiResolver (/var/task/node_modules/next/dist/server/api-utils/node.js:182:9)\n' +
      '    at async NextNodeServer.runApi (/var/task/node_modules/next/dist/server/next-server.js:386:9)',
    name: 'OPError'
  },
  providerId: 'facebook',
  message: 'expected 200 OK, got: 400 Bad Request'
}
2022-02-24T20:24:57.175Z	ea894128-a956-40cd-b023-dc791adc17a9	ERROR	[next-auth][error][CALLBACK_OAUTH_ERROR] 
https://next-auth.js.org/errors#callback_oauth_error expected 200 OK, got: 400 Bad Request OPError: expected 200 OK, got: 400 Bad Request
    at processResponse (/var/task/node_modules/openid-client/lib/helpers/process_response.js:41:11)
    at Client.grant (/var/task/node_modules/openid-client/lib/client.js:1340:22)
    at processTicksAndRejections (internal/process/task_queues.js:95:5)
    at async Client.oauthCallback (/var/task/node_modules/openid-client/lib/client.js:612:24)
    at async oAuthCallback (/var/task/node_modules/next-auth/core/lib/oauth/callback.js:114:16)
    at async Object.callback (/var/task/node_modules/next-auth/core/routes/callback.js:50:11)
    at async NextAuthHandler (/var/task/node_modules/next-auth/core/index.js:139:28)
    at async NextAuthNextHandler (/var/task/node_modules/next-auth/next/index.js:21:19)
    at async Object.apiResolver (/var/task/node_modules/next/dist/server/api-utils/node.js:182:9)
    at async NextNodeServer.runApi (/var/task/node_modules/next/dist/server/next-server.js:386:9) {
  name: 'OAuthCallbackError',
  code: undefined
}

How to reproduce

Publish to Vercel, and it will not work.

Expected behavior

It should allow a new user who signing up with Facebook to join.

[OivinF]

I am having this issue today, but it might be that I’m in a local environment from what I’m reading. (Even though I have a full https verified server behind a reverse proxy domain as my local dev environment). From what I’ve read here and in #3711 I’ll hold off trying to fix this until I’m on the final hardware and domains.

[balazsorban44]

If you think logging could be made better in any way, I’m open to it, please open a PR. 👍