You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am implementing next-auth with the Google provider and the JWT strategy without any database connected to it, so the token generated should be saved in the browser cookies only, I would like to understand better the authentication flow and the token refresh.
I am using next-auth 5.0.0-beta.21
I have this configuration (Just to understand better the flow of the auth 🙂)
The token from Google that has an expiration time of 1h, as I am not using a database I guess this is a one-time use token to generate the other two tokens.
The JWT token that I can see when the session callback is called, created correctly with an expiration time of 1 minute.
The Session that I see when I access /api/auth/session, also created correctly with an expiration time of 10 minutes.
However, every time I access a route (including the "/api/auth/session" route) or make any request, the JWT token and the Session are refreshed, each one with the right expiration time configured in the auth file and with the same information of the old one.
So using the configuration example mentioned above, while the user makes at least one request in less than a minute, the tokens will be always regenerated and the user will have access forever to the app.
Questions:
Is it right the token and the session are regenerated in each request? if so, is there a way to configure the refresh time?, I tried with updateAge but it seems it doesn't do anything.
To make an API request from Postman, can I use directly the JWT token or do I need to use the session to authenticate the request?
There is a way to prevent the token refresh when I am creating the request from postman?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
I am implementing next-auth with the Google provider and the JWT strategy without any database connected to it, so the token generated should be saved in the browser cookies only, I would like to understand better the authentication flow and the token refresh.
I am using next-auth 5.0.0-beta.21
I have this configuration (Just to understand better the flow of the auth 🙂)
So when I log in I can identify it generates:
session
callback is called, created correctly with an expiration time of 1 minute.However, every time I access a route (including the "/api/auth/session" route) or make any request, the JWT token and the Session are refreshed, each one with the right expiration time configured in the
auth
file and with the same information of the old one.So using the configuration example mentioned above, while the user makes at least one request in less than a minute, the tokens will be always regenerated and the user will have access forever to the app.
Questions:
updateAge
but it seems it doesn't do anything.Beta Was this translation helpful? Give feedback.
All reactions