fix(next-auth): prevent stale session fetches from resurrecting the session after signOut

[ytoshiki]

☕️ Reasoning

While looking into why a user can stay logged in after signOut(), I found a
race between sign-out and the refetches SessionProvider fires on its own
(mount, window focus, polling, cross-tab broadcasts):

1. a GET /api/auth/session starts (poll, focus, ...)
2. signOut() completes and clears the client state
3. the GET from step 1 resolves last and puts the old session back

With the default JWT strategy it's worse than a UI glitch: the session
endpoint re-signs the token and sets a fresh rolling cookie on every valid
GET, so the late response can leave the browser holding a valid session
cookie after sign-out. Reload and you're still logged in. This matches
long-standing reports like #4612.

The fix keeps an AbortController on __NEXTAUTH:

• signIn/signOut (and the WebAuthn signIn) abort any in-flight session
  fetch before sending their POST, and once more after it returns
• a session response is only applied if its fetch wasn't aborted or
  superseded by a newer one (fresh controller per fetch, newest wins)
• update() goes through the same guard
• a failed sign-in replays the refetch it aborted, and an aborted initial
  fetch keeps the status at "loading" instead of flashing "unauthenticated"
  (that flash could trigger useSession({ required: true }) redirects under
  StrictMode)

Two behavior changes worth calling out: a failed non-redirect signIn now
does one extra session GET (the replay), and update() resolves null when
it was superseded by an auth-state change.

What this can't fix from the client side: another tab's concurrent GET can
still get a rolling cookie, and JWT sessions can't be invalidated
server-side. Both are noted in code comments.

The tests reproduce the races deterministically by controlling fetch
resolution order — they fail without the fix. They're also the first React
client tests in this package, which is why the diff includes jsdom /
@testing-library/react / react-dom dev deps and a package-local vitest
config (the shared config aliases react to preact/compat, which breaks
@testing-library/react).

🧢 Checklist

• Documentation — not needed, JSDoc updated inline
• Tests
• Ready to be merged

🎫 Affected issues

Related: #4612, #12354, #3995, #3991

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
auth-docs	Ready	Preview, Comment	Jul 18, 2026 8:14am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
next-auth-docs	Ignored	Preview	Jul 18, 2026 8:14am

[vercel]

@ytoshiki is attempting to deploy a commit to the authjs Team on Vercel.

A member of the Team first needs to authorize it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jsdom@​24.1.3
	@​testing-library/​react@​14.3.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm data-urls is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/jsdom@24.1.3 → npm/data-urls@5.0.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/data-urls@5.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm rrweb-cssom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/jsdom@24.1.3 → npm/rrweb-cssom@0.7.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rrweb-cssom@0.7.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm rrweb-cssom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/jsdom@24.1.3 → npm/rrweb-cssom@0.8.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rrweb-cssom@0.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report