You shouldn't define a custom session route when using next-auth, its already handled by NextAuth. Your custom route leads it to recursion.