603466164219281420 #support-questions

i read one of the blogs posts and there was a section on theft detection. i wanted to know what the platform's plan is regarding theft in cases where the attacker has successfully stolen a refresh token, but the victim is not active for some period of time. for example, let's say the token gets stolen on a friday afternoon right before the victim logs off for the weekend. won't the attacker technically have access to this token, and can use it for a potentially long period of time?

09/21/2020, 4:31 PM

Yes. You’re right. They will have access. However, this is a subset of scenarios. There is currently no known good solution to this problem.

09/21/2020, 4:32 PM

But in your scenario, if the user logouts, then the refresh token that belongs to the attacker cannot be used anymore

09/21/2020, 4:32 PM

If the user is still logged in, and the app is “online” a potential solution is to do automatic background pings on behalf of the user

09/21/2020, 4:33 PM

In the case where the user is logged in, and the app is shut, there is no known good solution to this case.

user

09/21/2020, 4:34 PM

Gotcha. Thanks for the quick response!

kfrajer

09/29/2020, 9:15 PM

Can somebody share a link to invite to this server please?

09/29/2020, 9:16 PM

https://supertokens.io/discord

Bosky

10/29/2020, 12:04 PM

is this right, because first i got a TLS handshake error, then a

/handshake 502

error as per your docs i did

Copy code

app.use(supertokens.init({
    hosts: ["http://localhost:3001", myStagingWebsite, "https://try.supertokens.io", superTokensHostsString].join(";"),
    apiKey: apiKey
}));

10/29/2020, 12:04 PM

Try

Copy code

app.use(supertokens.init({
    hosts: superTokensHostsString,
    apiKey: apiKey
}));

10/29/2020, 12:05 PM

https://try.supertokens.io

is down at the moment. It's only meant for demo purposes and not meant to be used in development.

Bosky

10/29/2020, 12:07 PM

ok you should remove it from the docs then

10/29/2020, 12:08 PM

it's just an example in the docs. We can change it to replace the above host with your hosts. Or something like that. But thanks!

Bosky

10/29/2020, 12:10 PM

Ok, works now.

10/29/2020, 12:11 PM

cool

Bosky

10/29/2020, 12:24 PM

when a session does not exist, am getting a

Copy code

object Object]

printed on console although i havent console.log'd anything. I would like

Copy code

app.get('/', supertokens.middleware(), function(req,res){
   if(!req.session){ return redirect(); }
    ...

but right now it sends a response

Copy code

object Object]

as well as console logs the same as well

Bosky

10/29/2020, 12:25 PM

Copy code

// no affect
app.use(supertokens.errorHandler());

// add your error middleware
app.use((err, req, res, next) => {
    //not reaching here
    console.log('bad req:', err);
    res.status(500).send({bad_req:err});
})

Bosky

10/29/2020, 12:25 PM

how do i do

Copy code

app.get('/', supertokens.middleware(), function(req,res){
   if(!req.session){ return redirect(); }
    ...

Bosky

10/29/2020, 12:26 PM

without supertoken returning 500/response

10/29/2020, 12:27 PM

The console.log you have, shouldn't it print

Copy code

bad req: object Object]

10/29/2020, 12:28 PM

but you're saying it's printing

object Object]

10/29/2020, 12:29 PM

So, which console.log of yours is getting executed?

Bosky

10/29/2020, 12:30 PM

that's what I want to know. because I'm not printing any other console.log

Bosky

10/29/2020, 12:31 PM

btw, is there an alternative to

supertokens.middleware()

where i can say

let session = ....

10/29/2020, 12:33 PM

> that's what I want to know. because I'm not printing any other console.log That's really strange. Because our lib for sure has not console.log > is there an alternative to supertokens.middleware() Yes. You can do

Copy code

let session = await supertokens.getSession(req, res, true);

https://supertokens.io/docs/nodejs/api-reference/get-session

Bosky

10/29/2020, 12:40 PM

this is what i've had to avoid warnings . any improvements suggested ?

Copy code

let session = await supertokens.getSession(req, res, true).catch(er => er);
    if(session.err){ return redirect(); }

Bosky

10/29/2020, 12:40 PM

i had to add the catch

10/29/2020, 12:40 PM

if you are using await, you can surround with try and catch