What purpose does the `AUTH0_BASE_URL` serve?

[its]

I am using the library nextjs-auth0 and am trying to work on reducing the amount of configuration needed without our app. One of the required environment variables for the library is AUTH0_BASE_URL. I was able to avoid needing to set this by writing custom auth handlers to grab the URL from the request.

import {
  handleAuth,
  handleCallback,
  handleLogin,
  handleLogout,
} from "@auth0/nextjs-auth0";

function getBaseUrl(webUrl: string | undefined) {
  if (webUrl === undefined)
    throw new Error("Error get base Url. Missing request URL.");
  const urlObject = new URL(webUrl);
  return `${urlObject.protocol}//${urlObject.host}`;
}

process.env.AUTH0_BASE_URL ="http://somethingelse:3000"
export const GET = handleAuth({
  // @ts-ignore
  callback: (req, res) => {
    const baseUrl = getBaseUrl(req.url);
    return handleCallback(req, res, {
      authorizationParams: {
        audience: "https://ourURL.us.auth0.com/api/v2/",
        scope: "openid profile email offline_access",
        redirect_uri: `${baseUrl}/api/auth/callback`,
      },
      redirectUri: `${getBaseUrl(req.url)}/api/auth/callback`,
    });
  },
  // @ts-ignore
  login: (req, res) => {
    const baseUrl = getBaseUrl(req.url);
    return handleLogin({
      authorizationParams: {
        audience: "https://ourURL.us.auth0.com/api/v2/",
        scope: "openid profile email offline_access",
        redirect_uri: `${baseUrl}/api/auth/callback`,
      },
      returnTo: baseUrl,
    })(req, res);
  },
  // @ts-ignore
  logout: (req, res) => {
    return handleLogout({
      returnTo: getBaseUrl(req.url),
    })(req, res);
  },
});

It is also talked about on a few issues within the git project.

Override AUTH0_BASE_URL during runtime

Am I missing something important when it comes to security? Why wouldn’t this be the default way the library works? Is there some reason it would be bad to implement the library this way?

[tyf]

Hey there @its welcome to the community!

Sorry for the delayed response - I was just reading through the github repo issues and saw that we were able to get back to you there. Sharing here for future reference:

Remove the requirement to configure the `AUTH0_BASE_URL`

Cheers!