middleware expired jwt
Unanswered
Spectacled Caiman posted this in #help-forum
Spectacled CaimanOP
Hi all,
I have set up a custom backed with nextAuth credentials provider. Sign in, Sign out, middleware protection across the whole site - it all works fine. However, when A JWT expires I am still able to navigate the site and the middleware allows me to.
It's as simple as described in the docs:
How would I handle this situation? I wouldn't want to go ahead and fire a request to the backend with the expired token, it makes no sense since WE KNOW when it has expired?
Also another dumb question that will probably help me understand this: How is getServerSession() even a thing? Isn't the session local the the client? How would the server know whose session is this? I am new to frontend development, sorry if this is obvious.
I have set up a custom backed with nextAuth credentials provider. Sign in, Sign out, middleware protection across the whole site - it all works fine. However, when A JWT expires I am still able to navigate the site and the middleware allows me to.
It's as simple as described in the docs:
export { default } from "next-auth/middleware"How would I handle this situation? I wouldn't want to go ahead and fire a request to the backend with the expired token, it makes no sense since WE KNOW when it has expired?
Also another dumb question that will probably help me understand this: How is getServerSession() even a thing? Isn't the session local the the client? How would the server know whose session is this? I am new to frontend development, sorry if this is obvious.
5 Replies
Your JWT token automatically gets extended (and even the database sessions) whenever you access the sessions (and its active, meaning you arent signed out)
Also the getServerSession is explained here: https://next-auth.js.org/configuration/nextjs#getserversession
Its not stored on the server. You need to read the documentation more.
Its not stored on the server. You need to read the documentation more.
Spectacled CaimanOP
Thanks I'll have a look, but it's not automatically extended, when you try to access a resource, you get an expired error and have to re-authorize with username and pass
the way jwts work is that it can only be expired after the time originally set... you cant manually invalidate it without invalidating all other tokens...