Yeah, i did supertokens.init on the frontend. Apollo client uses fetch by default, no?

Yup

Can I see the request headers?

And how is session verification setup on the backend?

I am using Nest JS on the backend, and currently to test have the same stuff in the docs. In backend: ``const graphqlSchema = buildSchema(

type Query {
      hello: String
    }

); const resolvers = { hello: (_: any, context: any) => { console.log(context.session) return "Hello World" } }; app.use('/graphql', verifySession({ sessionRequired: true }), graphqlHTTP(async (req: any, res) => { return { schema: graphqlSchema, rootValue: resolvers, context: { session: req.session } } }));``

So you have marked sessionRequired as true

Which means that you will require a session to access the graphql endpoint

Maybe you meant to set it to false? This way even if a session doesn’t exist, you can call the graphql endpoint

Nope, I require it as true. This is the request header for the calling this endpoint.

Hmm

I may have configured apollo wrong as there is nothing on headers to suggest that there is a session?

I see. So what is your init function call on the frontend and backend?

Frontend: ``SuperTokens.init({ apiDomain: "http://localhost:3001" }); SuperTokensRequest.init({ apiDomain: "http://localhost:3001" }); const link = new HttpLink({uri: 'http://localhost:3001/graphql'}) const apolloClient = new ApolloClient({ link: (link as unknown) as ApolloLink, cache: new InMemoryCache() }) const apolloProvider = createApolloProvider({ defaultClient: apolloClient, }) ``

And how do you to the login / session creation operation?

Hi guys, are there any blogs on your website that provides details on the cybersecurity standards or safety provided by supertokens? Also, are you aware of any FDA approved organizations that are using your service?

hey @User we don't have any such formal material other than for sessions: - https://supertokens.com/blog/all-you-need-to-know-about-user-session-security All the code itself is open source, so feel free to inspect that. There could be open source users who require FDA approval that use SuperTokens. There is Circadia that is FDA approved and was using us for session management. It it is likely they still are (but cant gaurantee).

That being said, we are looking into getting SOC2 compliance + external code audit in the coming months.

(Jim - edited the message ^^)

Hello ! 👋 I am evaluating Ory Kratos and Supertokens. It looks like both can fit my needs, but my main concern in with the DB high availability part. I'm planning on deploying my app on a k8s cluster and using Yugabyte for the DB, and it seems Kratos does not support it according to some old github issue they had. I'm rather unimpressed with Ory's idea of high availability, which pretty much boils down to "we have infinite horizontal scaling capabilities as long as the DB follows, and that's not our problem", and then only allow pointing to a single hostname in the DB connection string. Even if I point to an haproxy or SQL proxy, I can't at least point to 2 and have a least one as a fallback. My questions would be : Can Supertokens be configured with multiple PGSQL targets in the connection string ? And before I go down that rabbit hole and test it myself, is anybody using Supertokens with Yugabyte as DB backend in production?

Kratos Yugabyte github issue for anyone curious : https://github.com/ory/kratos/issues/715

Hi all, we've been evaluating Supertokens as well, we were researching the flow and session management and had a question around session extension. Are there accommodations for usage-based session extension, for example, from a public machine? We have a heavy use case on public machines, our existing system uses a 'short-medium term lived access token whose usage extends their expiry' type of session management. Additionally, we have a mobile use case (and additional cases in the future) that fits perfectly with the 'suggested flow' (which is why we're evaluating Supertokens in the first place). We'd like to utilize the suggested Supertokens flow, but with the ability to extend a short-term session based on usage. We were wondering if this was a use case and if there were recommendations around this type of behavior

Hello 👋

Hi all weve been evaluating Supertokens

Hi, i am using verify middleware in route and i have also my own middleware which i used to to set some data into session . in my own middleware i used next() function but after using verify middleware next function it show me a error "TypeError: Cannot read property 'secure' of undefined"

I have the scopes I want to get from Google, but how do I pull the data from them?

OAuth info

Hi folks - is it possible to pass multiple domains for the websiteDomain parameter on backend NodeJS init?

We're using vercel for frontend deployments but all preview deploys are going to *.vercel.app instead of *.serifhealth.com.

So the API calls for our preview deployments all get 401'd

CORS config on the backend middleware is an array of values, so something like this is fine: ["*.serifhealth.com", "*.vercel.app"], but curious if SuperTokens init allows for multiple different TLD's.