Hey @rp I am getting a 500 internal server error if the authtoken is expired. So it should give a needs refresh response instead. I have two different services, in one it is working fine, but it is giving 500 error in one.

hey @ikak have you added our error handler in the one that's giving you a 500 error?

I am using FastAPI and hence have just used

session: SessionContainer = Depends(verify_session()

to check for seesion. WHere do I have to add an error handler?

Right. Do you see any backend error logs?

The backend is giving this error:

raise TryRefreshTokenError(ex) from None
supertokens_python.recipe.session.exceptions.TryRefreshTokenError: Access token expired

have you added

app.add_middleware(get_middleware())

to your backend?

Ohhh sorry about that somehow I missed adding the middleware. Thanks a lot.

can't. Cause the refresh token is only on the frontend

Okay so my understanding is that in the frontend first we have to send a request, if it returns a 401 status code with message needs refresh (we have to check the message because in case of unauthorized also the status code will be 401), then use Session.attemptRefreshingSession() to refresh session and then send the request again?

well, our frontend sdk should auto refresh for you.

Well as I told you I have two backend services (one made by me -> was giving 500 error and one by my friend -> was giving 401 error). When I make an axios call to his service, then first I get a 401 error response, and then a 200 okay response with correct data (I think the SDK is refreshing the cookie). But if i hit my service I just get the 401 error response in the catch block of the axios call, and the refreshing does not happen. The axios calls for both the requests is written by me and there is no differnce between them.

Oh I see. Are they two on different domains? What are the domains?

Currently both the backends are running on localhost, only thier ports are different.

Hmmm. For the other backend, you may want to get the access token on the frontend and add it as an authorizarion header to your request. This will ensure that the access token is always refreshed.

But I am already sending the auth token with my request cookie header (in both the requests)

right. The interception isn't applied to different port

Also one thing that I noticed is that when I hit 8001 request, the frontend receives 401 and executes the catch block of the axios call, but in case of 8000 request, the frontend receives 401 and then receives the data (it might be hitting the refresh endpoint in between) and hence executes the normal then block, which is weird.

Yea cause you have set the website domain to localhost:8000 correct?

Yeah thats correct

The use case you are trying to implement is best done if the 2 backend apis have the same domain or if they r on a sub domain. This way, you can share the cookie across the domains and won’t need to expose the access token to the frontend (plus auto refreshing will work)

Okay and just one more question, so suppose we have two different backend services running on different ports, so how do you suggest I authenticate and authorize a user (with the automatic refresh token functionality). Should I send request from one backend to the one running on port 8000 to validate the user and then it will send a response if a user is valid or not and if he needs to refresh his token.

No. Just expose the access token to the frontend and add it to each request.

Okay thanks a lot for your help sir.