Hello, we are pretty new to SuperTokens and I am exploring its capabilities. We are trying to implement 2 ways of communication with SuperTokens. 1. Our frontend to our backend. (Should be fine) 2. Third party to our backend. Right now, I am trying to implement the 2nd one, I tried to use the emailpassword way to do it to test. Basically I created a signin function to send post request with the email and password to the Middleware, get the response and set up the cookies (access, front and refresh token), same for signout and signup. The problem I am having is that whenever the access token expired (refresh token is still alive), it won't generate new access token (even though I sent a request to the /auth/session/refresh). Another question is there a suggested way to implement third party to our backend communication authentication with SuperTokens?

hey @y.s_

Erm, like a server to our backend

right. So why would that server need to do email password login?

Yeah i understand that, right now I am just testing how it works

ah ok. So for baceknd to backend, this might help: https://supertokens.com/docs/microservice_auth/introduction

Okay thank you!!

the auto refreshing only happens using our frontend sdk which is meant for frontend clients

Yeah, I made the request call manually, but it return unauthorized message, 401

how are you making the request?

something like this

@supertokens_blueprint.route("/test-refresh", methods=["GET","POST"])
def refresh_token():
    url = "http://localhost:5000/auth/session/refresh"

    try:
        response = requests.post(url)
        if response.status_code == 200:
            access_token_expiration_time = datetime.utcnow() + timedelta(seconds=180)
            access_token = response.headers.get("st-access-token")
            resp = make_response("Refresh successful")
            resp.set_cookie("sAccessToken", access_token, expires=access_token_expiration_time.strftime('%a, %d %b %Y %H:%M:%S GMT'), httponly=True, path="/", samesite='Lax')

            return resp
        else:
            data = response.json()
            return data['message']

    except requests.RequestException as e:
        return f"Error during refresh: {str(e)}", 500

are you providing the refresh token in the refresh API?

I think so

i don't see that in the code above though

@supertokens_blueprint.route("/test-login", methods=["GET", "POST"])
def test_login():
    url = "http://localhost:5000/auth/signin"
    try:
        response = requests.post(url, json=payload)
        
        access_token = response.headers.get("st-access-token")
        front_token = response.headers.get("front-token")
        refresh_token = response.headers.get("st-refresh-token")

        if access_token and front_token and refresh_token:
            access_token_expiration_time = datetime.utcnow() + timedelta(seconds=180)
            refresh_token_expiration_time = datetime.utcnow() + timedelta(days=1)
            resp = make_response("Login successful")
            resp.set_cookie("sAccessToken", access_token, expires=access_token_expiration_time.strftime('%a, %d %b %Y %H:%M:%S GMT'), httponly=True, path="/", samesite='Lax')
            resp.set_cookie("sFrontToken", front_token, samesite='Lax')
            resp.set_cookie("sRefreshToken", refresh_token , expires=refresh_token_expiration_time.strftime('%a, %d %b %Y %H:%M:%S GMT'), httponly=True, path="/", samesite='Lax')
            return resp
        else:
            return "Missing tokens in the response headers", 500

this is the test-login, not sure whether i set the cookie correctly

im a little confused at what you are trying to do

I am trying to set cookie in flask, then use it to access protected route

why arent you just calling the sign in API that we have directly from the frontend?

Because there might be a feature that we want to implement in the future where the user can directly communicate with our backend server using email and password

well in that case, in the above code, why are you seeting the access and refresh token in the response? Isn't it all just backend to backend? So shouldnt you save the tokens in the db or somewhere?

Yeah yeah, will do that later, but currently just testing the function

righ

part of the cookie in request header no?

No it can be a part of the cookie in the request header as well, but where are you attaching that cookie? In the core above, i don't see any headers being added to the refresh POST API call.

hmm, I didn't attach it, but it is showing that the refreshtoken is part of the request headers already

how is this showing on the browser?

hahaha, we use python flask as our backend, I am just creating extra route to test

sorry, but your setup isn't clear. The refresh API request needs to the refresh token. So when calling it from your backend, make sure to add it. The screenshot above indicates that it's being transferred from your frontend to your backend (Cause it's a browser screenshot), but from there on, im not sure what you do with the refresh token.

Ahh okok, thanks man, sorry for causing inconvenience😂

no worries 🙂