Auth.js and NextAuth.js Penetration Testing
Auth.js authenticates the user; everything after that is your code to secure. We test what the callbacks trust, what the session hands to the client, and whether routes check access themselves. CREST-certified testers, fixed price from £3,180 for a 2-day single-integration scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Callbacks are the functions where Auth.js hands control back to your code: to decide who can sign in, what a token carries and what the client is allowed to see.
Auth.js signs a user in; your callbacks decide what that session is allowed to carry
Auth.js is deliberately unopinionated. It gives you callbacks named signIn, jwt, session and redirect and lets you decide what each one does, rather than shipping a dashboard of switches the way a hosted identity provider does. That flexibility is why Auth.js’s own guidance on protecting resources is explicit that middleware alone is not enough: Auth.js runs the function you wrote, and it trusts what that function returns.
The session strategy compounds this. A JWT session is never looked up once it is issued, so a claim written into the token during the jwt callback, or a role that should have been revoked, stays valid until the token expires. A database session avoids that problem, but only if your adapter and sign-out logic actually delete the session row rather than leaving it live. Either way, whether an OAuth account gets linked to an existing user by email address alone, through allowDangerousEmailAccountLinking, is a configuration decision that sits in the same file as everything else.
Risk outside the callbacks follows the same pattern: a redirect callback that stops restricting destinations to your own origin once someone customises it, a CSRF check disabled on a route because it got in the way during development, and route handlers or server actions that assume the proxy upstream already checked the session. Each of these is a place where Auth.js did exactly what it was configured to do, and the configuration did not hold.
SCOPE
What we pen test on an Auth.js integration
Sign-in callback trust boundaries
Whether the signIn callback, which decides if a sign-in is allowed, checks the account, profile or email data it receives against your own records rather than trusting it outright, and whether returning false or a redirect URL genuinely blocks access rather than only changing what the user sees.
JWT callback and token claims
Whether data written into the token during the jwt callback, such as a role or permission copied from the profile, is ever revalidated, since Auth.js only passes the original account and profile on the first call and just the existing token on every call after that.
Session callback and client exposure
Whether the session callback forwards only the fields your client actually needs, or copies the token or user object across wholesale, so that useSession() and auth() hand the browser data such as internal identifiers or provider access tokens it was never meant to see.
Session strategy: JWT or database
Whether the application relies on the default JWT session, which is not looked up anywhere and stays valid until it expires, or a database session backed by an adapter, where signing a user out or deleting their session row is what actually revokes access.
AUTH_SECRET and cookie handling
Whether AUTH_SECRET, or the older NEXTAUTH_SECRET, is an explicit and sufficiently random value in production rather than the value Auth.js derives automatically in development, since that secret encrypts the session cookie and is used to hash verification tokens.
Account linking
Whether any provider is configured with allowDangerousEmailAccountLinking, which links a new OAuth sign-in to an existing account by email address alone, and if so whether every linked provider genuinely verifies that email before an attacker could take over an account using a matching but unverified address.
Redirect callback and open redirect
Whether a customised redirect callback still restricts destinations to your own origin the way Auth.js’s default implementation does, or accepts an external callback URL parameter that turns the sign-in flow into an open redirect usable for phishing.
CSRF token handling for sign-in
Whether the CSRF token Auth.js issues for the double submit cookie check is actually required on credentials sign-in requests, and, for OAuth providers, whether the state and PKCE checks configured on the authorisation callback have been left enabled rather than disabled for convenience.
Middleware and route-level checks
Whether protection enforced in proxy.ts or middleware actually covers every route in its matcher, and whether the route handlers and server actions underneath still verify the session for themselves, since Auth.js’s own guidance is not to rely on the proxy exclusively for authorisation.
Credentials provider validation
Where a Credentials provider is configured, whether its authorize() function validates and rate-limits the input itself, since Auth.js applies no validation to credentials by default, and whether a failed attempt returns a generic error rather than confirming which accounts exist.
OUR PROCESS
Auth.js and NextAuth.js Integration Penetration Testing: From Scope to Attestation
Map the integration
We catalogue every Auth.js touchpoint in scope: the callbacks configured in your auth config, the session strategy and adapter in use, every provider, and where AUTH_SECRET and provider credentials are stored.
Provision test accounts across providers
We work from test accounts on every configured provider, including any Credentials provider, so callback logic, account linking and token claims are tested against a real sign-in rather than assumptions about the config.
Callback, session and redirect exploitation
CREST-certified testers attempt to bypass the signIn callback, tamper with token and session data, trigger account linking on an unverified email, and abuse the redirect callback and CSRF checks.
Reporting and retest
Executive summary, technical report with CVSS scores and reproduction steps, a walkthrough call, and a free retest once fixes are in place.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Auth.js pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Auth.js and NextAuth.js Integration Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Auth.js For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Auth.js and NextAuth.js Integration Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Auth.js integration?
A test environment with your auth configuration deployed, credentials for a test account on each provider you use, such as Google or a Credentials provider, and either read access to your callback and adapter code or a staging environment we can sign in to directly. We do not need your production AUTH_SECRET or provider client secrets; test values are enough.
Will this touch our live user data?
No. Testing runs against a staging environment and test accounts you provision for us. If a shared environment cannot be avoided, we scope the engagement to test accounts only and agree data-handling rules with you before testing starts.
Auth.js is a library you self-host, not a hosted service like Auth0. Does that change what you test?
It changes where the risk sits rather than reducing it. There is no vendor dashboard or hosted login page to review; every callback, the session strategy, the adapter and the routes that check the session are code your team wrote and control, so that is what we test in full.
How long does an Auth.js integration test take?
A single-integration scope like this one starts at 2 testing days, with results delivered around 5 working days after kickoff. Multiple providers, a custom Credentials provider, or an extensive permission model built on top of the session take longer; we confirm exact days once we see your setup.
What is out of scope?
The Auth.js and NextAuth.js library code itself, and the OAuth providers you connect to, such as Google or GitHub, are out of scope. We focus on your configuration: the callbacks, session handling, adapter, provider setup and the routes and server actions that depend on the session.
Do you need permission from the Auth.js maintainers to test this?
No. Auth.js runs entirely inside your own application, so there is no separate hosted platform to seek permission for, unlike a SaaS identity provider. The OAuth providers you connect to are separate services with their own terms, which we do not test directly. Auth.js’s maintainers do run a responsible-disclosure process for vulnerabilities in the library itself, which is separate from testing your integration and something we confirm the current terms of during scoping.
Do you need our database or adapter credentials?
No, not your production ones. If you use a database session strategy, we work with a test database or adapter instance you provision, covering the same session and account tables Auth.js manages. Your live AUTH_SECRET and production database credentials should never be shared with a third party, including us.
Is Auth.js the same as NextAuth.js?
Yes. NextAuth.js is the name the project used before the maintainers renamed it Auth.js, and the same package continues to support both current Auth.js and legacy v4 NextAuth.js installations. This page covers integrations built on either version under the project’s current name.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Auth.js integration
Auth.js authenticates the user; everything after that is your code to secure. We test what the callbacks trust, what the session hands to the client, and whether routes check access themselves. CREST-certified testers, fixed price from £3,180 for a 2-day single-integration scope, quoted within 24 hours.
