Hello! Quick question about the refresh token theft detection: does supertokens only store one parent refresh token? If so, what happens if an attacker refreshes the token let’s say, 3 times while the user is idle? Then the user comes back online to refresh their token? By storing only the last one used, wouldn’t we be unable to detect this?

> Should the fetch interceptor be auto-trying to refresh the token here or is this something I need to manually handle? @User This should be happening. If you are using

axios

, then make sure that you have added the interceptor to it.

Hmm okay, for this particular setup, I'm just trying to get things working with fetch

@User > By storing only the last one used, wouldn’t we be unable to detect this? In your scenario, the user would be using a refresh token whose parent, or itself would be in the db, however, the associated session handle would still be in the db. This would be enough of an indication of token theft and it would give you that error.

@User , okay. In the request, do you see a header called

rid

?

So in the request, the only thing I'm seeing that's related to supertokens is the cookie, which has

sIdRefreshToken

,

sIRTFrontend

and

sFrontToken

values

The response headers don't seem to have anything related to supertokens in them

Understood. This means interception is not being applied

Which can happen is u have disabled interception, or if your apiDomain value is not set correctly

What’s your apiDomain? And where is this request going to?

everything is currently just running on localhost... I have a Next.js app that hosts an endpoint which acts as a simple proxy to a private api

The apiDomain has to be equal to the domain where fetch is querying

If fetch is querying http://localhost:3000/api/…

Then apiDomain must be http://localhost:3000

Otherwise the interception will not be applied

right, ok, I think that should be setup correctly

I have websiteDomain === apiDomain

and apiBasePath = '/api/auth'

I'm pretty sure I've got that right, otherwise the signup/signin functionality wouldn't work, correct?

Yeaaaa. True

Okay. So then assuming that’s correct, is it possible that the supertokens.init code isn’t being called on the page you are loading?

I don't think so... I've got it in the same block inside

_app.js

Hmmmm

it's one line after the supertokens-auth-react.init()

Can we get on a call to debug?

I'm not in a good spot for voice right now

I’ll send u my Calendly. You. Can pick a slot that works for you?

Sure, I'm gonna be out of town for a few days so it'll have to be next week (sorry, wrapping things up before a short vacay here, lol)

No worries!

Please see DM