Implement `authorize()` Against Your Backend
Use a trusted HTTPS backend for password verification. Normalize and validate input, send credentials only to that backend, handle unsuccessful responses, and return a stable user ID plus only the safe profile fields needed by the application.
Authorize implementation
async authorize(credentials) {
const email = credentials?.email?.trim().toLowerCase();
const password = credentials?.password;
if (!email || typeof password !== "string" || !password) return null;
const response = await fetch(`${process.env.AUTH_API_URL}/auth/login`, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ email, password }),
cache: "no-store",
});
if (!response.ok) return null;
const result = await response.json();
const user = result?.user;
if (!user?.id || !user?.email) return null;
return {
id: String(user.id),
name: user.name ?? null,
email: user.email,
image: user.image ?? null,
role: user.role ?? "user",
};
}💡 Change the endpoint and response contract to your actual backend. The server must check account status, rate limits, MFA where applicable, and password hashes.