Custom session expire date #2790
-
Question 💬I want to modify the session expire date to keep it consistency with a one of the token expire date from server. Currently what I did is just to change the session by You can see there are some format difference between two strings; My question: Is this enough to be handled automatically by
|
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 8 replies
-
|
The session expiry is not the same as a third party access token. next-auth rotates the session expiry, meaning whenever the client contacts the backend, it will update the session expiry date. (which is basically the cookie lifetime) with other words, the session doesn't have a fixed/absolute expiry time as usually access tokens have. If the user doesn't open the page for a while, the cookie will expire and will be removed automatically. so make sure the session expiry is always lower than your access token expiry date, if you cannot refresh the access token. hope that makes sense! |
Beta Was this translation helpful? Give feedback.
-
|
@balazsorban44 Thanks a lot, that cleans out some of my misunderstanding about the session handling. Just a follow up, if I don't misunderstand how it works, So when the next-auth session expire, what happen is that it will re-trig the Since you mention "The session expiry is not the same as a third party access token" |
Beta Was this translation helpful? Give feedback.
-
|
If the ⚠ I was recently made aware, that the token rotation tutorial should probably advocate for using a database adapter instead of strong a refresh token in JWT, but at the very least, you should encrypt it! |
Beta Was this translation helpful? Give feedback.
-
|
@balazsorban44 |
Beta Was this translation helpful? Give feedback.
-
|
@aboveyunhai how have you implemented the access token rotation logic? So I was wondering how you have got it to be happening automatically. |
Beta Was this translation helpful? Give feedback.
-
|
I can't remember the exact details, There is a callbacks: {
async jwt(stored_token, ...args) {
// intial
// you need to handle all the init errors and edge cases.
if (login) {
const token_WIth_Remote_Data = await callRemoteBackend();
return token_WIth_Remote_Data
}
// token rotation
// you need to handle all the rotation errors and edge cases.
// if error, maybe logout user or do the attempt several times with a threshold, check network condition?
if (stored_token has "remote token data" or user changing page, reopen page) {
// there is a rotation algorithm you need to implement
// to ensure both remote backend and next.js backend token in sync
const condtion = some_algo_calculation_upon_expired_date(a_global_interval)
if (just expire_token is expired) {
// not need to rotate, just logout user
}
if (algo condition match hence only the rotation token expire) {
// update rotation token. still valid user
const new_token = await refreshTokenFromRemoteBackend();
token = { ...new_token }
}
}
return token.
}
},
async session(session, user_and_token) {
// persist remote token data across session
if (user_and_token){
session.user = user_and_token,user;
session.remote_data = user_and_token.remote_data;
}
return session;
}
}The above code will be executed in sync if you handle it correctly. Then in your provider in </Provider>
options={{
keepAlive: a_global_interval // this mean the callback will be fired periodically
}}
</Provider> |
Beta Was this translation helpful? Give feedback.
-
|
ohh! Thanks a lot. I wasn't expecting such a great answer. I have the whole token rotation working fine, I just wanted to know how others have built their solutions. |
Beta Was this translation helpful? Give feedback.
-
|
I have a requirement that when closing browser it should expire session. how can we achive it |
Beta Was this translation helpful? Give feedback.
-
|
In my opinion, you will have to write a custom logic which runs before tab/browser is closed, you will have to ensure there's enough time for custom logic to run when the tab/browser is closed. I think it is still not a good requirement because what if user's laptop dies out all of a sudden then any custom logic that you might have written won't get time to run. In that custom logic you will have to forcefully expire users session. For OAuth, you will have to log the user out by making a signout API call to identity provider. |
Beta Was this translation helpful? Give feedback.
-
|
Just use session storage. All data will be discarded upon the app close. You shall not rely on any custom logic to detect user behavior like tabs, leaving windows, etc. |
Beta Was this translation helpful? Give feedback.
-
|
@aboveyunhai Can you guide me through it? currently my token stored as cookie with lifetime of 1 day (JWT expiration) |
Beta Was this translation helpful? Give feedback.
The session expiry is not the same as a third party access token. next-auth rotates the session expiry, meaning whenever the client contacts the backend, it will update the session expiry date. (which is basically the cookie lifetime)
with other words, the session doesn't have a fixed/absolute expiry time as usually access tokens have.
If the user doesn't open the page for a while, the cookie will expire and will be removed automatically. so make sure the session expiry is always lower than your access token expiry date, if you cannot refresh the access token.
hope that makes sense!