server actions not working when published to vercel

[gilesbradshaw]

I am running the example application deployed in vercel.https://next-auth-nextjs-g2tkj0nv4-gilesbs-projects.vercel.app/
On my localhost server actions are posted to root and 303 with a {} and a redirect.
on vercel they 303 but return a not found page. The redirect url goes in the address bar but the browser does not redirect.
Does anyone know why this is?

Here's it working on my local host nb the {} returned:

curl 'http://localhost:3001/' -X POST -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0' -H 'Accept: text/x-component' -H 'Accept-Language: en-GB,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br' -H 'Referer: http://localhost:3001/' -H 'Next-Action: 6cbe8929c812f3cc00bda55eb4b90b584bec63e2' -H 'Next-Router-State-Tree: %5B%22%22%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2F%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D' -H 'Content-Type: multipart/form-data; boundary=---------------------------20370102129208257622015956660' -H 'Origin: http://localhost:3001' -H 'Connection: keep-alive' -H 'Cookie: authjs.csrf-token=b9810291a9381873bc312493cee1e71b140182334ad6120cf4336739c6d225c0%7C9810ac6b17b9a10a31228761f577b9e564e159dd19dc1cc0572e5bd5c25ba844; authjs.callback-url=http%3A%2F%2Flocalhost%3A3001%2F' -H 'Sec-Fetch-Dest: empty' -H 'Sec-Fetch-Mode: cors' -H 'Sec-Fetch-Site: same-origin' --data-binary $'-----------------------------20370102129208257622015956660\r\nContent-Disposition: form-data; name="1_$ACTION_ID_6cbe8929c812f3cc00bda55eb4b90b584bec63e2"\r\n\r\n\r\n-----------------------------20370102129208257622015956660\r\nContent-Disposition: form-data; name="1_link"\r\n\r\nhttp://localhost:3001/auth/signin?callbackUrl=http%3A%2F%2Flocalhost%3A3001%2F\r\n-----------------------------20370102129208257622015956660\r\nContent-Disposition: form-data; name="0"\r\n\r\n["$K1"]\r\n-----------------------------20370102129208257622015956660--\r\n' -v
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 127.0.0.1:3001...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 3001 (#0)
> POST / HTTP/1.1
> Host: localhost:3001
> User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0
> Accept: text/x-component
> Accept-Language: en-GB,en;q=0.5
> Accept-Encoding: gzip, deflate, br
> Referer: http://localhost:3001/
> Next-Action: 6cbe8929c812f3cc00bda55eb4b90b584bec63e2
> Next-Router-State-Tree: %5B%22%22%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2F%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D
> Content-Type: multipart/form-data; boundary=---------------------------20370102129208257622015956660
> Origin: http://localhost:3001
> Connection: keep-alive
> Cookie: authjs.csrf-token=b9810291a9381873bc312493cee1e71b140182334ad6120cf4336739c6d225c0%7C9810ac6b17b9a10a31228761f577b9e564e159dd19dc1cc0572e5bd5c25ba844; authjs.callback-url=http%3A%2F%2Flocalhost%3A3001%2F
> Sec-Fetch-Dest: empty
> Sec-Fetch-Mode: cors
> Sec-Fetch-Site: same-origin
> Content-Length: 522
> 
* upload completely sent off: 522 out of 522 bytes
* Mark bundle as not supporting multiuse
< HTTP/1.1 303 See Other
< Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
< Cache-Control: no-store, must-revalidate
< x-action-revalidated: [[],0,0]
< x-action-redirect: http://localhost:3001/auth/signin?callbackUrl=http%3A%2F%2Flocalhost%3A3001%2F
< X-Powered-By: Next.js
< ETag: "bwc9mymkdm2"
< Content-Type: text/html; charset=utf-8
< Content-Length: 2
< Date: Wed, 24 Apr 2024 10:01:14 GMT
< Connection: keep-alive
< Keep-Alive: timeout=5
< 
* Connection #0 to host localhost left intact
{}

this is the result on vercel

curl 'https://next-auth-nextjs-gold.vercel.app/' -X POST -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0' -H 'Accept: text/x-component' -H 'Accept-Language: en-GB,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br' -H 'Referer: https://next-auth-nextjs-gold.vercel.app/' -H 'Next-Action: bb8cd3ea5f4bdb28d35978aee1121b18c391f5cd' -H 'Next-Router-State-Tree: %5B%22%22%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2F%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D' -H 'Content-Type: multipart/form-data; boundary=---------------------------16281445939559039591030528965' -H 'Origin: https://next-auth-nextjs-gold.vercel.app' -H 'Connection: keep-alive' -H 'Cookie: __Host-authjs.csrf-token=53da12d129aaec3ba2db97c4d75fd581be1b3840e2445ec74ba6ad8d86ebd038%7C2d3073aa4b42f483a45c53feb315dd7528d36bb18dedb5fe380feb69b7be9bce; __Secure-authjs.callback-url=https%3A%2F%2Fnext-auth-nextjs-gold.vercel.app%2F' -H 'Sec-Fetch-Dest: empty' -H 'Sec-Fetch-Mode: cors' -H 'Sec-Fetch-Site: same-origin' --data-binary $'-----------------------------16281445939559039591030528965\r\nContent-Disposition: form-data; name="1_$ACTION_ID_bb8cd3ea5f4bdb28d35978aee1121b18c391f5cd"\r\n\r\n\r\n-----------------------------16281445939559039591030528965\r\nContent-Disposition: form-data; name="1_link"\r\n\r\nhttps://next-auth-nextjs-gold.vercel.app/auth/signin?callbackUrl=https%3A%2F%2Fnext-auth-nextjs-gold.vercel.app%2F\r\n-----------------------------16281445939559039591030528965\r\nContent-Disposition: form-data; name="0"\r\n\r\n["$K1"]\r\n-----------------------------16281445939559039591030528965--\r\n' -v
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 76.76.21.9:443...
* TCP_NODELAY set
* Connected to next-auth-nextjs-gold.vercel.app (76.76.21.9) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=*.vercel.app
*  start date: Apr 15 01:56:22 2024 GMT
*  expire date: Jul 14 01:56:21 2024 GMT
*  subjectAltName: host "next-auth-nextjs-gold.vercel.app" matched cert's "*.vercel.app"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x55dbbfda7650)
> POST / HTTP/2
> Host: next-auth-nextjs-gold.vercel.app
> user-agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0
> accept: text/x-component
> accept-language: en-GB,en;q=0.5
> accept-encoding: gzip, deflate, br
> referer: https://next-auth-nextjs-gold.vercel.app/
> next-action: bb8cd3ea5f4bdb28d35978aee1121b18c391f5cd
> next-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2F%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D
> content-type: multipart/form-data; boundary=---------------------------16281445939559039591030528965
> origin: https://next-auth-nextjs-gold.vercel.app
> connection: keep-alive
> cookie: __Host-authjs.csrf-token=53da12d129aaec3ba2db97c4d75fd581be1b3840e2445ec74ba6ad8d86ebd038%7C2d3073aa4b42f483a45c53feb315dd7528d36bb18dedb5fe380feb69b7be9bce; __Secure-authjs.callback-url=https%3A%2F%2Fnext-auth-nextjs-gold.vercel.app%2F
> sec-fetch-dest: empty
> sec-fetch-mode: cors
> sec-fetch-site: same-origin
> content-length: 558
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* We are completely uploaded and fine
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
< HTTP/2 303 
< age: 0
< cache-control: private, no-cache, no-store, max-age=0, must-revalidate
< content-type: text/x-component
< date: Wed, 24 Apr 2024 09:56:29 GMT
< server: Vercel
< strict-transport-security: max-age=63072000; includeSubDomains; preload
< vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch
< x-action-redirect: https://next-auth-nextjs-gold.vercel.app/auth/signin?callbackUrl=https%3A%2F%2Fnext-auth-nextjs-gold.vercel.app%2F
< x-action-revalidated: [[],0,0]
< x-matched-path: /_not-found
< x-powered-by: Next.js
< x-vercel-cache: MISS
< x-vercel-execution-region: iad1
< x-vercel-id: lhr1:lhr1:iad1::iad1::iad1::rldzp-1713952589138-67daca84f724
< 
2:I[1561,[],""]
3:I[9772,[],""]
9:I[4714,["714","static/chunks/714-f7b155852cb7a1ab.js","185","static/chunks/app/layout-8375b3be56af9e21.js"],""]
5:{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"}
6:{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"}
7:{"display":"inline-block"}
8:{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0}
0:["ZeU-c8ncIToZzms3gtt6k",[[["",{"children":["/_not-found",{"children":["__PAGE__?{\"callbackUrl\":\"https://next-auth-nextjs-gold.vercel.app/\"}",{}]}]},"$undefined","$undefined",true],["",{"children":["/_not-found",{"children":["__PAGE__",{},[["$L1",[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":"404"}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]]],null],null]},["$","$L2",null,{"parallelRouterKey":"children","segmentPath":["children","/_not-found","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L3",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","notFoundStyles":"$undefined","styles":null}],null]},[["$","html",null,{"children":["$","body",null,{"children":["$L4",["$","main",null,{"children":["$","$L2",null,{"parallelRouterKey":"children","segmentPath":["children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L3",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":"$5","children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":"$6","children":"404"}],["$","div",null,{"style":"$7","children":["$","h2",null,{"style":"$8","children":"This page could not be found."}]}]]}]}]],"notFoundStyles":[],"styles":null}]}],["$","footer",null,{"className":"footer_footer__mqdak","children":["$","ul",null,{"className":"footer_navItems__kbeQ7","children":[["$","div",null,{"className":"footer_navItemsLeft__32Z_N","children":[["$","li",null,{"className":"footer_navItem__6iI_7","children":[["$","a",null,{"href":"https://authjs.dev","children":"Documentation"}],["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","width":"24","height":"24","viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":"2","strokeLinecap":"round","strokeLinejoin":"round","children":[["$","path",null,{"d":"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"}],["$","polyline",null,{"points":"15 3 21 3 21 9"}],["$","line",null,{"x1":"10","x2":"21","y1":"14","y2":"3"}]]}]]}],["$","li",null,{"className":"footer_navItem__6iI_7","children":[["$","a",null,{"href":"https://www.npmjs.com/package/next-auth","children":"NPM"}],["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","width":"24","height":"24","viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":"2","strokeLinecap":"round","strokeLinejoin":"round","children":[["$","path",null,{"d":"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"}],["$","polyline",null,{"points":"15 3 21 3 21 9"}],["$","line",null,{"x1":"10","x2":"21","y1":"14","y2":"3"}]]}]]}],["$","li",null,{"className":"footer_navItem__6iI_7","children":[["$","a",null,{"href":"https://github.com/nextauthjs/next-auth-example","children":"GitHub"}],["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","width":"24","height":"24","viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":"2","strokeLinecap":"round","strokeLinejoin":"round","children":[["$","path",null,{"d":"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"}],["$","polyline",null,{"points":"15 3 21 3 21 9"}],["$","line",null,{"x1":"10","x2":"21","y1":"14","y2":"3"}]]}]]}],["$","li",null,{"className":"footer_navItem__6iI_7","children":["$","$L9",null,{"href":"/policy","children":"Policy"}]}]]}],["$","li",null,{"className":"footer_navItem__6iI_7","style":{"margin":"0"},"children":[["$","img",null,{"className":"footer_footerLogo__so9J9","src":"https://authjs.dev/img/logo-sm.png","alt":"Auth.js Logo"}],["$","span",null,{"children":"5.0.0-beta.16"}]]}]]}]}]]}]}],null],null],[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/css/8dbbeea0d34f89bd.css","precedence":"next","crossOrigin":"$undefined"}]],"$La"]]]]
a:[["$","meta","0",{"name":"viewport","content":"width=device-width, initial-scale=1"}],["$","meta","1",{"charSet":"utf-8"}]]
1:null
b:{"id":"31cd527d6d745831f6dfdd15cbda394f02a23edd","bound":null}
c:{"id":"bb8cd3ea5f4bdb28d35978aee1121b18c391f5cd","bound":null}
4:[["$","header",null,{"className":"header_header__zJOD0","children":[["$","div",null,{"className":"header_signedInStatus__T3rmy","children":[["$","img",null,{"src":"https://source.boringavatars.com/beam/120","className":"header_avatar__zMOp5"}],[["$","span",null,{"className":"header_notSignedInText__SezUf","children":"You are not signed in"}],["$","form",null,{"action":"$Fb","children":["$","button",null,{"className":"header_buttonPrimary__pb7Po","children":"Sign in"}]}]]]}],["$","nav",null,{"children":["$","ul",null,{"className":"header_navItems__h_HqL","children":[["$","$L9",null,{"href":"/","className":"header_navItem__3VVay","children":"Home (app)"}],["$","$L9",null,{"className":"header_navItem__3VVay","href":"/dashboard","children":"Dashboard (app)"}],["$","$L9",null,{"className":"header_navItem__3VVay","href":"/policy","children":"Policy (pages)"}],["$","$L9",null,{"className":"header_navItem__3VVay","href":"/credentials","children":"Credentials (pages)"}],["$","$L9",null,{"className":"header_navItem__3VVay","href":"/protected-ssr","children":"getServerSideProps (pages)"}],["$","$L9",null,{"className":"header_navItem__3VVay","href":"/api/examples/protected","children":"API Route (pages)"}]]}]}]]}],["$","form",null,{"action":"$Fc","children":[["$","input",null,{"type":"text","name":"link","placeholder":"link"}],["$","button",null,{"className":"header_buttonPrimary__pb7Po","children":"test"}]]}]]
* Connection #0 to host next-auth-nextjs-gold.vercel.app left intact
* ```

[gilesbradshaw]

looking at this some more - the problem is redirecting to the signin page.

I made a test button here https://next-auth-nextjs-gold.vercel.app/ which just redirects to any link.

If I try and redirect to the sign in page from this deployment https://next-auth-nextjs-gold.vercel.app/auth/signin?callbackUrl=https%3A%2F%2Fnext-auth-nextjs-gold.vercel.app%2F (which is what the sign in button does) then it gives this error.

I can point my browser to it and it works fine

however if I redirect to the equivalent page on another deployment it redirects fine eg https://next-auth-nextjs-git-working-main-gilesbs-projects.vercel.app/auth/signin?callbackUrl=https%3A%2F%2Fnext-auth-nextjs-git-working-main-gilesbs-projects.vercel.app%2F