Hi, thanks a lot for the great work with this project! We are using supertokens in our fastAPI backend and react frontend. Very often, when I'm calling my protected endpoints a lot of calls are made to authenticate slowing down my the whole application for multiple seconds. I'm assuming that this happens when the refresh token is being updated. The uesr experience become very bad when this happens and we would appreciate getting some help to solve this problem. Thanks!

Hey @humam

Hi, of course The example:

@router.get(
    "/get",
    response_model=List[str],
    summary="Get all leads associated with a user.",
)
def get_leads(
    session: SessionContainer = Depends(verify_session()),
):
    try:
        leads = get_leads_for_user(session.user_id)
        return leads
    except Exception as e:
        return HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))

How often does it slow down? Just during session refreshing? Or other times too?

I think only during session refreshing

Hmm.

This happens when I stop using the progrm for x amount of minutes so I'm assuming it 's refreshing

How much time does it take? And how many calls to the core happen? (You can see by adding core interceptor callback in the backend SDK and logging there)

I cannot replicate the problems because the token has already been refreshed. Is there a way for me to force it to refresh?

Delete the sAccessToken cookie from the frontend and call an api that uses the verify session function

ok thank you

Hmm. That’s weird. So the frontend does 14 calls to the backend to refresh the session?

The backend is doing 14 calls. To be more precise the intercept function that I added to my backend is printing 14 times

So frontend to backed is 1 call to refresh, but backend to core is 14?

exactly

That’s odd

I can show you the log but I dunno if it contains any sensitive information

You can DM it to me if u like

that'd be great thank you

In the interceptor you added, can you log out the request paths? And also, make sure you only send me the output of that interceptor for one refresh call that the frontend makes.

Hmm I don't really undrestand what do you mean by request paths. How can I access them inside the interceptor function? Also do you want me to disable backend debugging?

the

url

argument. Print that out

I'm already printing it out

right. Can i see the output of just that?

and only when the frontend makes one refresh call

For some reason it's going faster now but I'll still DM you the logs

so one refresh from the frontend seems to be calling one refresh to the core, as expected

when it slows down significantly it also makes calls to /auth/user/email/verify is this expected?

that would be in the api call after the refresh has sent a response to the frontend

the interceptor function prints 7 times during this call

are you using email verification recipe in required mode?

yes

is the user's email is verified?

The profile is created using SSO so it should be verified

right.

How can I double-check that?

im not sure

I'm running my backend locally using WSL

have you made any change to the email verification validator setting?

I've overridden: emailverificaion, create_new_session, thirdparty_sign_in_up_post, emailpassword_sign_up_post as well as email_verify_post

right

yeah could be because it happens frequently

So the email verification status in the session's access token payload is updated once every 10 mins when you call verify_session

oh ok this could be the root cause of the problem

you can change the time to be like 1 hour or somethring instead of 10 mins

Is there anything else that I can do to stop this from happening? would making emailverificaion as Optional help?

you can set the time to 1 year of you want.. effectively making it never refresh

if the account is verified then this should not be an issue?

correct. Unless, you manually mark it as unverified on the backend somehow, then the existing session will never know about this.. cause it never refreshes that claim

Interesting. I'll try with a longer time to begin with. Hopefully the issue should disappear for now

i'll send over a snippet for how to do this.

perfect! I'll let you know

something like this in the backend's session.init:

def session_function_override(oI: RecipeInterface) -> RecipeInterface:
    async def new_get_global_claim_validators(
        tenant_id: str,
        user_id: str,
        claim_validators_added_by_other_recipes: List[SessionClaimValidator],
        user_context: Dict[str, Any],
    ):
        # remove certain item from claim_validators_added_by_other_recipes
        claim_validators_added_by_other_recipes = [
            validator
            for validator in claim_validators_added_by_other_recipes
            if validator.id != "st-ev"
        ]

        claim_validators_added_by_other_recipes.append(emailverification.EmailVerificationClaim.validators.is_verified(10, 10000000000))
        return claim_validators_added_by_other_recipes

    oI.get_global_claim_validators = new_get_global_claim_validators
    return oI


session.init(override=session.InputOverrideConfig(functions=session_function_override))

I tried once and it didn't help the same behavior happened. It tried calling /auth/user/email/verify 6times and made tons of calls to core.

can you show me the debug logs?

yeah of course

and only during the time of the api call

Hi! It's still making calls to /auth/user/email/verify

did that expression return true?

I wasn't debugging when that happened so I don' really know but I'll make sure to print the value of the expression the whole time

cool.

Ok I'll write to you when I have more input on what's happening. thanks!