[Bug]: Zod validation error

[anandrajsingh]

Sandbox ID or Build ID

No response

Environment

Ubuntu 24.04

Timestamp of the issue

2026-02-14 05:42:58 UTC

Frequency

Happens every time

Expected behavior

Authentication should work on local also, without zod validation error

Actual behavior

Can't verify email in local setup as zod schema expects a proper domain.

Issue reproduction

After signup, you recieve email to verify email

Additional context

const confirmSchema = z.object({
token_hash: z.string().min(1),
type: OtpTypeSchema,
next: z.httpUrl(),
})

The above code is from /api/auth/confirm route, same is in the /confirm page which uses ConfirmEmailInputSchema from auth.model.ts

[linear]

ENG-3504

[anandrajsingh]

@ben-fornefeld are you the one maintaining this repo?

[taheerahmed]

I looked into this the issue is that z.httpUrl() (Zod 4) requires a proper domain with a TLD, which rejects localhost URLs during local development.

The fix is to replace z.httpUrl() with z.url() in both the /api/auth/confirm route and the shared ConfirmEmailInputSchema. z.url() still validates that the string is a well-formed URL, but accepts localhost.

This doesn't weaken security since the actual redirect protection is already handled by isExternalOrigin() and buildRedirectUrl() downstream.

Opened a PR with the fix: #249

Would love if you guys looked into it @mishushakov