custom session expiry per user

Question

I want to log the user out when their subscription is ended Is there any way I can set custom expiry to cookies and sessions for each user based on their subscription The default time will be 7 days but users with less than 7 days remaining on their subscription will have the session cookies expiry date the same as their subscription end date

rp · Answer

yes this is possible You can add another custom claim in the session s access token payload indicating when the subscription is about to end using the createNewSession override Then post session verification you can check if the claim indicates that the subscription end date has already passed or not and if it has then send back a 401 You will also need to override the refresh function to call the original implementation first and then check the access token payload from the resulting session object If it indicates that the subscription has gotten over then call `session revokeSession` An alternative method would be to have a cronjob in your system which would check for each user if their subscription has finished and then if it has then call the session revokeAllSessionsForUser function for that user This will log the user out the next time their session refreshes

rp · Answer

st bot test case

undesiredmonk · Answer

Can we override verifySession for this

rp · Answer

you can make your own verifySession middleware which is based on our getSession function https supertokens com docs session common customizations sessions session verification in api get session getsession vs verifysession

undesiredmonk · Answer

I m using fastify The verifySession method seems to be different for fastify

undesiredmonk · Answer

I made my own verify session middleware I m using fastify `export const verifySession = options VerifySessionOptions => return async req SessionRequest reply FastifyReply => try if options sessionRequired === false req as any session = await Session getSession req reply antiCsrfCheck options antiCsrfCheck overrideGlobalClaimValidators options overrideGlobalClaimValidators sessionRequired false else req as any session = await Session getSession req reply antiCsrfCheck options antiCsrfCheck overrideGlobalClaimValidators options overrideGlobalClaimValidators sessionRequired true const payload = req session getAccessTokenPayload const isSubscribed = payload isSubscribed if isSubscribed await req session revokeSession reply status 401 catch error if SuperTokensError isErrorFromSuperTokens error switch error type case Session Error TRY REFRESH TOKEN reply status 401 send message Session Error TRY REFRESH TOKEN break case Session Error UNAUTHORISED reply status 401 send message Session Error UNAUTHORISED break case Session Error TOKEN THEFT DETECTED req session revokeSession reply status 401 send message Session Error TOKEN THEFT DETECTED break case Session Error INVALID CLAIMS reply status 401 send message Session Error INVALID CLAIMS break reply status 401 send message error message else reply status 401 send error `

undesiredmonk · Answer

I m getting following error when fetching the refresh token after the cookie expires ```TypeError res setHeader is not a function at appendToServerResponse node modules pnpm supertokens node 12 1 4 node modules supertokens node lib build framework utils js 298 9 at Object setCookieForServerResponse node modules pnpm supertokens node 12 1 4 node modules supertokens node lib build framework utils js 277 12 at ExpressResponse setCookie node modules pnpm supertokens node 12 1 4 node modules supertokens node lib build framework express framework js 121 21 at setCookie node modules pnpm supertokens node 12 1 4 node modules supertokens node lib build recipe session cookieAndHeaders js 103 16 at Object attachAccessTokenToCookie node modules pnpm supertokens node 12 1 4 node modules supertokens node lib build recipe session cookieAndHeaders js 26 5 at Object node modules pnpm supertokens node 12 1 4 node modules supertokens node lib build recipe session recipeImplementation js 212 40 at Generator next at fulfilled node modules pnpm supertokens node 12 1 4 node modules supertokens node lib build recipe session recipeImplementation js 15 36 at runMicrotasks at processTicksAndRejections node internal process task queues 96 5 ```

undesiredmonk · Answer

I m using fastify And this issue doesn t happen if i use the verifySession method provided

rp · Answer

So this error comes during refreshing a session

undesiredmonk · Answer

Yes When the cookie expires and calls for the refresh token

undesiredmonk · Answer

How can I override refresh token logic