cool

ok both the request and response have rid: "anti-csrf"

Hmm. The response shouldn't have the rid.

But at least the request has it. So the interceptor is being applied

Let us try and replicate this issue.

If we can't, then maybe we can get on a call to see what's happening

sure I can always share my screen

actually, i would be happy to do that now anyway. I'll DM you a zoom link

great

thx!!

link sent.

Does the client need to receive a 401 to trigger a refresh ?

Yes. It does.

You can change this status code if you like. There is an option on the frontend and backend SDKs for that.

ok got it. so what happened is my middleware threw a forbidden 403 somehow, I corrected it to a 401 and now the refresh always works!

thx a lot for your help

awesome! :))

Hi, I know flutter is not supported with supertokens, but as a more general question: Since the dart http package still does not support cookies, the only way would be the jwt only route, right? 🤔

We actually do have an outdated flutter SDK which is a private repo. In that, we do cookie management manually

and it works.

😮

it's just a bit outdated now and works with a very older version of the backend SDKs.. so we made it private. Once it's updated, we can make it public again

How do you do that? I mean, I can extract the cookies from the headers, but would have to set them manually on each subsequent request since they do not get attached automatically. So there is the issue with persistence, saving it in shared_preferences would result in the refresh token being saved to local storage.

> I can extract the cookies from the headers, but would have to set them manually on each subsequent request We have interceptors that would do that for you. > So there is the issue with persistence, saving it in shared_preferences would result in the refresh token being saved to local storage. Yes. But unlike the browser, the risk of token theft via XSS is very low on mobile apps.

Thing is, I want to first try my app as a pwa and if it succeeds expand to the app stores, so this could be an issue if someone visits from desktop 😬

perhaps @User can shed some light here.

@User Like rp explained we do have a flutter SDK, but its a bit out of date at the moment. What you explained is exactly what we are doing at the moment but it was built with mobile only in mind (flutter web was in alpha at the time if I remember correctly), so yes using it with flutter web the refresh token would get saved in local storage.

Unfortunately I cant think of any workaround for this because of how limited http is with cookies

@User Thanks for explaining. Yes it's surprising that such a basic functionality is still not implemented by the dart team. So regardless if one uses access token only or access & refresh tokens (this is probably more work for no additional benefit when in localstorage, correct?) the problem remains that it is open for csrf, right?

One way to look at it would be to store in storage only for mobile and handle other platforms separately. I’m not sure of how http behaves on web (if it relies on browser cookie handling then it should work just fine)