-
-
Notifications
You must be signed in to change notification settings - Fork 3.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SvelteKit Auth + refresh token rotation not working as expected #6447
Comments
I've tried to follow the refresh token guideline as well, and I couldn't get the refreshed
On the client side, it's persisted in a session cookie, but only once , on your initial login. Since you're refreshing from |
I'm having the same issue. When you use the export const load: LayoutServerLoad = async ({ fetch }) => {
const r = await fetch('/auth/session');
const res = await r.json();
console.log(res);
return {
session: res
};
}; This actually persists the new jwt, so you don't keep refreshing the token on every request. So I like to also save the expiration time of the token, and schedule a function to run to invalidate it forcing a call to the server to refresh: setTimeout(() => {
// invalidate session, force fetch for new token
invalidate('/auth/session');
}, expiration); |
@half2me Just curious where you added the timer to refresh the token? |
Just in my layout's onLoad() I use Houdini to access a GraphQL API that needs this token to work. I also added an exception handler to the houdini client to detect 401 errors and retry the request with a new token, just in case the timer doesn't trigger. (When the device sleeps etc, it can happen) |
Sorry but does this work? It seems like a dirty hack |
@rbozan works fine for me 🤷 . If there is any better way to do it, I'm all ears. |
I'm doing something similar. I'm not happy with it, but it's working. In +layout.server.ts
In layout.svelte
|
@bfbay315 yeah, in my case I only invalidate the auth endpoint instead of everything, but otherwise same idea. It works 🤷 |
I think this was recently addressed - refer. You must be on or above v0.10.0 of |
currently testing out authjs and the new |
Finally, I found solution for this issue: https://blog.aakashgoplani.in/how-to-implement-refresh-token-rotation-in-sveltekitauth |
Environment
Reproduction URL
https://github.com/nicklasbondesson/sveltekitauth-token-rotation-demo
Describe the issue
I'm trying to implement refresh token rotation (JWT) based on the guide over here https://authjs.dev/guides/basics/refresh-token-rotation using the recently released SvelteKit Auth.
Once the access token has expired and is refreshed it seems that it is not remembered anymore, as shown below.
Here's the entry point to the demo code where it can be reproduced.
How to reproduce
Follow the README in here https://github.com/nicklasbondesson/sveltekitauth-token-rotation-demo
Expected behavior
I think the expected behaviour would be that the refreshed token(s) would be remembered, just as it was on the initial login. If not, I would very much welcome some clarity around the matter.
The text was updated successfully, but these errors were encountered: