SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).

SuperTokens.com

image

I am working currently on the multitenancy as subdomain in my app and I am not getting the session when authorizing the role of the user it doesn't get pass the verifySession. Even though I am signed in correctly and I am using the prebuiltUI as well. I will attach the debug log and the signed network log

hey <@305516093949083648> whats the request header of the API call look like in which you get a 401?

whats the configured apiDomain on the frontend? and whats the URL you are sending the API request to in the above screenshot? Do those values match?

the apiDomain is http://example.com:3000 I made the localhost in an alias so that the subdomain works

the url for api request has a subdomain so like http://subdomain.example.com:3000

but, you can get it to work. See this: https://supertokens.com/docs/session/common-customizations/sessions/share-sessions-across-sub-domains

hmm <@498057949541826571> I tried adding the sessionTokenFrontendDomain: ".example.com" in the frontendConfig and it is working since I was able to access example.com when I only logged into the subdomain.example.com but I still have the same issue do I need to work on configuring the accessTokenPayload talked about here?

not sure what you mean. Is the access token now being sent as a st-access-token header in the request headers (not in cookies)?

enable our frontend debug logs and show the output when you call this API please.

snapnoa-example-com-1708625927087

instead of setting sessionTokenFrontendDomain, set the sessionTokenBackendDomain to `.example.com`

<@498057949541826571> I think I found the issue in that for the sign in when I check the network tab the url sends the sign in to example.com even though I signed into the subdomain.example.com so example.com has the access token in the cookie but subdomain.example.com doesn't

Are these your frontend domains or backend?

for the subdomain.example.com it's the frontend so in the url it says that but when I check the backend from the network tab it says example.com

Right. So you also need to set sessionTokenFrontendDomain

I did both but it still fails and now there is a infinite loop on refresh session

I had to make the api domain for the frontend window.location.origin as well