603466164219281420 #general

Response {
  "_bodyBlob": Blob {
    "_data": Object {
      "__collector": Object {},
      "blobId": "684EFC19-282D-4351-B18F-F5867E415EC8",
      "name": "refresh",
      "offset": 0,
      "size": 1383,
      "type": "application/json",
    },
  },
  "_bodyInit": Blob {
    "_data": Object {
      "__collector": Object {},
      "blobId": "684EFC19-282D-4351-B18F-F5867E415EC8",
      "name": "refresh",
      "offset": 0,
      "size": 1383,
      "type": "application/json",
    },
  },

Sun Walker

06/16/2020, 4:46 PM

Copy code

"headers": Headers {
    "map": Object {
      "access-control-allow-credentials": "true",
      "access-control-expose-headers": "id-refresh-token, anti-csrf",
      "anti-csrf": "2147e6e2-5e56-46d5-a408-4e462b3fe229",
      "connection": "keep-alive",
      "content-encoding": "gzip",
      "content-type": "application/json; charset=utf-8",
      "date": "Tue, 16 Jun 2020 16:44:07 GMT",
      "etag": "W/\"567-wUbSNrVsti+Zw4kRHc1R5Ma0hpM\"",
      "id-refresh-token": "7825bd80-045b-4c40-8ae4-27694af3dd0b;1592325907773",
      "set-cookie": "sAccessToken=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsInZlcnNpb24iOiIxIn0%3D.eyJzZXNzaW9uSGFuZGxlIjoiZmY5YjhkMjUtM2RkYS00Y2U4LThmZWYtOWRlODAwOGI4MWE5IiwidXNlcklkIjoiNDExNWM1ZGYtOGNmMS00MDI5LWE1NjUtZDRlZWNiZDczNDU4IiwicmVmcmVzaFRva2VuSGFzaDEiOiJkZjQxYmQwZDk0MjkwNjU3ZGU2ODI3ODY5MDA5OGM3YjU2MWEyYTRkYzk3ZDg3NTQ0Y2EyYWI2YjVmZjBhMDUzIiwicGFyZW50UmVmcmVzaFRva2VuSGFzaDEiOiI4MjNkNDY1NzQwNjgwYTg4N2FmNTFmY2RiZDdhMzIzOWYwOGVjZDY2Njg2YTdlNTkwYWY3NjYwNTViM2JiYmQ5IiwidXNlckRhdGEiOnsidXNlclR5cGUiOiJhZG1pbiIsImlzUHJvdmlkZXIiOnRydWV9LCJhbnRpQ3NyZlRva2VuIjoiMjE0N2U2ZTItNWU1Ni00NmQ1LWE0MDgtNGU0NjJiM2ZlMjI5IiwiZXhwaXJ5VGltZSI6MTU5MjMyNTg1Nzc3NSwidGltZUNyZWF0ZWQiOjE1OTIzMjU4NDc3NzUsImlzUGFpZCI6ZmFsc2V9.Jv2RDFHkUySiyUXVtxQEJwGdsSDG1ONSY%2Baf%2BiVz1tB5

Sun Walker

06/16/2020, 4:46 PM

Copy code

"strict-transport-security": "max-age=15552000; includeSubDomains",
      "transfer-encoding": "Identity",
      "vary": "Origin, Accept-Encoding",
      "x-content-type-options": "nosniff",
      "x-dns-prefetch-control": "off",
      "x-download-options": "noopen",
      "x-frame-options": "SAMEORIGIN",
      "x-xss-protection": "1; mode=block",
    },
  },
  "ok": true,
  "status": 201,
  "statusText": undefined,
  "type": "default",
  "url": "http://127.0.0.1:4000/refresh",
}

Sun Walker

06/16/2020, 4:57 PM

Copy code

export const attemptRefreshSession = async (req: Request, res: Response) => {
  try {
    await refreshSession(req, res);
    return env !== 'development' ? true : developmentCookieResponse(res);
  } catch (err) {
    const authError = Error.isErrorFromAuth(err);

    if (authError && err.errType === Error.UNAUTHORISED) {
      throw createHttpError(440, {
        message: 'Unauthorized. Please Login.',
        err,
      });
    }
    if (authError && err.errType !== Error.GENERAL_ERROR) {
      const sessionHandle = err?.err?.sessionHandle;
      const successfulRevoke = await revokeSession(sessionHandle);
      throw createHttpError(440, {
        message: `${successfulRevoke ? 'Session Revoked. ' : ''}Please Login.`,
        err,
      });
    }
    throw createHttpError(500, { err });
  }
};

Sun Walker

06/16/2020, 4:57 PM

Copy code

export const refresh: Route = {
  method: 'post',
  path: '/refresh',
  secure: false,
  handler: [
    async (req, res) => {
      const success = await attemptRefreshSession(req, res);
      return res
        .status(201)
        .send({ success, message: 'Successful Session Refresh.' });
    },
  ],
};

06/16/2020, 5:02 PM

You don't need to do refreshing of tokens on your own - it is handled by the SDK on it's own. You just need to add inteceptors to your fetch or axios

06/16/2020, 5:02 PM

@User - If i undertsand your code correctly that is.

Sun Walker

06/16/2020, 5:08 PM

Yeah the axios has interceptors @rp Im using the one provided (supertokens.axios) with credentials

06/16/2020, 5:09 PM

I see. So that should do the refreshing on its own.

Sun Walker

06/16/2020, 5:09 PM

it all works great but whenever I post to /refresh it gives back an error? what should i do ? (it still successfully refreshes)

Sun Walker

06/16/2020, 5:09 PM

Ah so I can delete my /refresh?

Sun Walker

06/16/2020, 5:09 PM

I dont do any /refresh calls it does call it on its own

Sun Walker

06/16/2020, 5:10 PM

it just comes back as an error whenever the access token gets refreshed

Sun Walker

06/16/2020, 5:30 PM

Also @User I've set this to 1 minute but it takes longer than 1 minute to expire it seems

Copy code

# (OPTIONAL | Default: 144000) double value. Time in mins for how long a refresh token is valid for.
refresh_token_validity: 1

Sun Walker

06/16/2020, 5:30 PM

It expires in less than 30 minutes but not 1 minute

Sun Walker

06/16/2020, 5:31 PM

I know this because the sdk is making successful refreshreshes every 10 seconds (for way longer than 1 minute) as I put this:

Copy code

# (OPTIONAL | Default: 3600) integer value. Time in seconds for how long an access token is valid for.
access_token_validity: 10

(which are working well, but coming back as errors to the client)

Sun Walker

06/16/2020, 5:34 PM

Perhaps the refreshes change the time...

06/16/2020, 5:41 PM

> Ah so I can delete my /refresh? In your backend APIs, no.

06/16/2020, 5:42 PM

> I've set this to 1 minute So this means that it will expire after 1 min of inactivity. If you call a refresh API within 1 min, the session lifetime will be extended by one more min.

Sun Walker

06/16/2020, 5:44 PM

I see!

Sun Walker

06/16/2020, 5:44 PM

so if user is inactive for 144000 mins by default

06/16/2020, 5:45 PM

Also, your refresh API can literally look like this:

Copy code

app.post("/refresh", supertokens.middleware(), (req, res) => {
    res.send("");
});

That is, you don't need to call supertokens.refreshSession yourself.

Sun Walker

06/16/2020, 5:45 PM

And in terms of the error my client is getting for a successful refresh, what do you think the issue could be, what am I doing wrong

Sun Walker

06/16/2020, 5:45 PM

Ah I see, I'll change it to this!

06/16/2020, 5:46 PM

I'm not entirely sure what is wrong. But try following the code snippets in the docs as closely as possible. Maybe the error will just "go away" then

06/16/2020, 5:48 PM

In the above code snippet, "/refresh" should be in your config.yaml file + in your frontend SDK, the URL for the refresh API should be "http://127.0.0.1:4000/refresh"