and the server does the same

okay. Now, so according to me, nextJS should just forward that cookie to the /api/user API. Does that happen?

yes

great. so in that case /user/api should work whilst the access token is still valid.

yes

Now to handle the case where it's invalid, you need to call the refresh token API. In order to do that,

if we see on server, token is invalid, we need to try refreshToken. if success -> doing next(), if no, return an error?

one min.. let me write the flow down properly

- "/user" gets valid access token -> "/api/user" gets valid access token and it works. - "/user" gets no access token -> "/api/user" gets no access token -> getSession function throws TRY_REFRESH_TOKEN or UNAUTHORISED error -> "/user" gets session expired status code from "/api/user". At this point, we need to somehow call refresh token API. - since the refresh token is not sent to "/user", (it's stored in the frontend), "/user" API should return some html/js that will call the refresh token API (this call will be made on the frontend. See https://supertokens.github.io/supertokens-website/docs/fetch/non-spa). - if that call on the frontend succeeds, then it should call the "/user" API again, everything will work (since you have a new access token). If this call fails with session expiry, then the session has expired and the user must login again

I hope this makes sense.

not explained it in the clearest of ways.

thank you so much for the instruction

if things still don't work, I'm happy to get on a call to explain this part.

@rp problem with createNewSession, function have second parameter as userId, i dont have userId yet. create with custom userId and recreate session after user auth success? Or i can change userId in exists session?

R u trying to create an anonymous session?

hm, i can to do this?

i just use createNewSession

So normally that function is to be used after authenticating a user. At that point, u should have some unique Id for ur users

If I want to create a session before login (which is what I call anonymous session), then you can simply pass some random string as a userId

Or even an empty string

okey, thanks. userId set empty, and then recreate session

Yup.

@rp Hi. the session object must store the authentication data and the state of this data. There is no such information in this session

/auth/callback drops on if (!req.session[key])

the library is not made yet to be compatible with PassportJS as of yet in case that's the issue

but, you can always change the session object returned from getSession to make it compatible yourself.

also, req.session[key] --> (await req.session.getSessionInfo()).key

or req.session.getJWTPayload().key

depending on from where you are getting the info that is mapped to key

I will try, thanks