🙂

yea! definitely. Thanks for your help too. And good luck to you.

sure. you can ping us here anytime.

Hey @User . I was going through your middleware code here: https://pastebin.com/HZaRcsDQ A few points: - I do not see anything specific to integration with PassportJS. Am I missing something? - Line 23, you call the refreshSession function. This implies that you are sending the refresh token on each API call as well. This is incorrect, as the refresh token is to be sent ONLY to the refresh API. That API should not use this middleware - If the refreshSession function (in the refresh API), throws a session expired error, then you should wither ask the user to sign in again, or create a new session. - if the getSession function throws a TRY_REFRESH_TOKEN error, then you should sent 440 to the frontend (which will then try to call the refresh API) If I have misunderstood your code, please feel free to correct me.

pasportjs expects a session object in req. This function creates it in context.

@rp and in passport auth

example of initialization

there is a slight minus. For anonymous users, many database entries are created. perhaps this can somehow be avoided?

my POST /auth/refresh code. Is that correct?

https://pastebin.com/QsrJ80CX so it turns out more correct?

> there is a slight minus. For anonymous users, many database entries are created. perhaps this can somehow be avoided? @User For now, we don't support anonymous sessions. So this is unavoidable.

> my POST /auth/refresh code. Is that correct? @User yes. One more thing is that in catch, the library may also throw TOKEN_THEFT_DETECTED error.. in which case there has been an attack on this session - so you may want to revoke that session

> https://pastebin.com/QsrJ80CX so it turns out more correct? @User yes. it looks good!

@User Hi. removalCronjobInterval: "0 0 0 1-31/7 * *", drop all data in the session table?

do u mean "drop" or "drops" - it would be nice for you to elaborate more on your question.

cleaning up 🙂

merciless removal

sorry.. still not sure what you are trying to ask. Do you mean to ask: "what that cronjob is doing and why it's there?"

is this option located in refreshToken, does it only delete sessions that run out of time, or is it all from the table?

it's only sessions that have expired.

so that you save on space.

revokeSession remove record from refresh_token? @User

yes.

cause you are revoking that session. so its refresh_token is removed.

good solution to remove anonymous when user authorize

yup. that is a good idea. You should do that

ideally, do the following: - authenticate a user (yielding their userId) - get current session - get sessionData from the current session - revoke old session - create a new session for userId giving it sessionData as well

Here's a problem we are running into: on our frontend, we call the logout endpoint of our API which gets the session and revokes it according to your documentation. However, after the successful logout call, calling

SuperTokensRequest.sessionPossiblyExists()

on the frontend still returns true.

checking in the browser, the cookies are successfully removed

Please share the library name and version