-
Notifications
You must be signed in to change notification settings - Fork 4k
Custom session expire date #2790
-
QuestionI want to modify the session expire date to keep it consistency with a one of the token expire date from server. Currently what I did is just to change the session by session(session, userOrToken) {2021-10-18T23:00:01.182Z <---- next-auth default generated stringYou can see there are some format difference between two strings; My question: Is this enough to be handled automatically by
|
Beta Was this translation helpful? Give feedback.
All reactions
The session expiry is not the same as a third party access token. next-auth rotates the session expiry, meaning whenever the client contacts the backend, it will update the session expiry date. (which is basically the cookie lifetime)
with other words, the session doesn't have a fixed/absolute expiry time as usually access tokens have.
If the user doesn't open the page for a while, the cookie will expire and will be removed automatically. so make sure the session expiry is always lower than your access token expiry date, if you cannot refresh the access token.
hope that makes sense!
Replies: 3 comments 9 replies
-
|
The session expiry is not the same as a third party access token. next-auth rotates the session expiry, meaning whenever the client contacts the backend, it will update the session expiry date. (which is basically the cookie lifetime) with other words, the session doesn't have a fixed/absolute expiry time as usually access tokens have. If the user doesn't open the page for a while, the cookie will expire and will be removed automatically. so make sure the session expiry is always lower than your access token expiry date, if you cannot refresh the access token. hope that makes sense! |
Beta Was this translation helpful? Give feedback.
All reactions
-
8
-
|
@balazsorban44 Thanks a lot, that cleans out some of my misunderstanding about the session handling. Just a follow up, if I don't misunderstand how it works, So when the next-auth session expire, what happen is that it will re-trig the Since you mention "The session expiry is not the same as a third party access token" |
Beta Was this translation helpful? Give feedback.
All reactions
-
|
If the I was recently made aware, that the token rotation tutorial should probably advocate for using a database adapter instead of strong a refresh token in JWT, but at the very least, you should encrypt it! |
Beta Was this translation helpful? Give feedback.
All reactions
-
|
@balazsorban44 |
Beta Was this translation helpful? Give feedback.
All reactions
-
Beta Was this translation helpful? Give feedback.
All reactions
-
|
@aboveyunhai how have you implemented the access token rotation logic? So I was wondering how you have got it to be happening automatically. |
Beta Was this translation helpful? Give feedback.
All reactions
-
|
I can't remember the exact details, There is a callbacks: {
async jwt(stored_token, ...args) { // intial // you need to handle all the init errors and edge cases. if (login) { const token_WIth_Remote_Data = await callRemoteBackend(); return token_WIth_Remote_Data } // token rotation // you need to handle all the rotation errors and edge cases. // if error, maybe logout user or do the attempt several times with a threshold, check network condition? if (stored_token has "remote token data" or user changing page, reopen page) { // there is a rotation algorithm you need to implement // to ensure both remote backend and next.js backend token in sync const condtion = some_algo_calculation_upon_expired_date(a_global_interval) if (just expire_token is expired) { // not need to rotate, just logout user } if (algo condition match hence only the rotation token expire) { // update rotation token. still valid user const new_token = await refreshTokenFromRemoteBackend(); token = { ...new_token } } } return token. } }, async session(session, user_and_token) { // persist remote token data across session if (user_and_token){ session.user = user_and_token,user; session.remote_data = user_and_token.remote_data; } return session; } } The above code will be executed in sync if you handle it correctly. Then in your provider in </Provider>
options={{ keepAlive: a_global_interval // this mean the callback will be fired periodically }} </Provider> |
Beta Was this translation helpful? Give feedback.
All reactions
-
2
-
|
ohh! Thanks a lot. I wasn't expecting such a great answer. I have the whole token rotation working fine, I just wanted to know how others have built their solutions. |
Beta Was this translation helpful? Give feedback.
All reactions
-
1
-
|
I have a requirement that when closing browser it should expire session. how can we achive it |
Beta Was this translation helpful? Give feedback.
All reactions
-
|
In my opinion, you will have to write a custom logic which runs before tab/browser is closed, you will have to ensure there's enough time for custom logic to run when the tab/browser is closed. I think it is still not a good requirement because what if user's laptop dies out all of a sudden then any custom logic that you might have written won't get time to run. In that custom logic you will have to forcefully expire users session. For OAuth, you will have to log the user out by making a signout API call to identity provider. |
Beta Was this translation helpful? Give feedback.
All reactions
-
|
Just use session storage. All data will be discarded upon the app close. You shall not rely on any custom logic to detect user behavior like tabs, leaving windows, etc. |
Beta Was this translation helpful? Give feedback.
All reactions
-
2
-
|
@aboveyunhai Can you guide me through it? currently my token stored as cookie with lifetime of 1 day (JWT expiration) |
Beta Was this translation helpful? Give feedback.