Question about sharing sessions across subdomains....
# support-questions-legacy
d
Question about sharing sessions across subdomains...
Is it possible to detect when a session has been signed out? If a user signs out from one subdomain, in the other subdomains I want to detect this and cause a page refresh (or some other appropriate action).
BTW, it was pretty easy to get sessions working across subdomains. Nice!!
r
Yea. First, you have to enable sharing sessions across sub domains (https://supertokens.com/docs/session/common-customizations/sessions/share-sessions-across-sub-domains) Then, you can add event listeners in session.init to listen for the sign out event and do whats needed: https://supertokens.com/docs/session/advanced-customizations/frontend-hooks/handle-event
d
Oh, perfect, that's exactly what I needed. Sorry I missed that. Thanks!!
The events are triggered within the same app/subdomain/tab, but not in the other apps/subdomain/tabs. What I want to be able to do is to detect the events in any other open tab that is running a different app on a different subdomain.
When I refresh in the other app, the change gets detected, but I want to be able to detect the event without having to wait for the user to refresh.
r
ahright. So the event will only be fired on the tab in which the user did the action for logout
to fire in other tabs, you can make your own event and fire that on other tabs via some localstorage sync and get it to work that way
d
Ok, got it. Thanks.
I have been investigating this problem. As I dig deeper, it keeps turning out to be a little more complex, and I have now come full circle back to SuperTokens. First, using localStorage does not seem to be a great solution after all. If I didn’t need multiple subdomains, perhaps, but localStorage is unique to each origin. A different subdomain is a different origin, so it won’t work, at least not out of the box. There are hacks, like using postMessage() from iFrame, but I don’t like those kinds of hackish and messy approaches. I was thinking of just using Firestore because I am already integrated. My first thought was to just keep track of state very simply in a single boolean variable, i.e. isAuthenticated = true | false. Firebase allows me to create an Observable directly on the variable so that I am informed virtually instantly of any changes. That would really make the tracking ulta-simple in my app. Alas, that won’t work either. Putting aside the fact that I would effectively be duplicating part of the SuperTokens core, don’t forget that the purpose is to track authentication. To read the variable, either the user has to be authenticated or the variable has to be left readable even when not authenticated. The latter is no good, which means that the app can only track the variable when authenticated. This means I could detect a signout, but not a signin. So it seems to me now that the only reasonable way to do this is to keep polling SuperTokens for the existence of a Session by calling Session.doesSessionExist(). That could work, but it is not ideal because I don't like the idea of having to set up a polling mechanism. It would be great if SuperTokens provided an observable out of the box (either instead of or in addition to the promise) to allow this kind of tracking in real time, so a client can easily subscribe, and the moment the state changes, the app can take action. I will set up the polling anyway, but I thought I would share my progress. wdyt?
r
Oh. You can try storing it on frontend cookies with cookieDomain as .domain.com and poll that instead
d
Ok, good thinking. I'll give that a try.
Hey, just another question... but since there is already a cookie provided by SuperTokens, and the cookie has a value
sIRTFrontend
, couldn't I just use that? Is there a reason why you are not suggesting this, and are instead suggesting that I use my own cookie?
r
Oh yea. You can just use that.
d
But in that case, since the frontend code is just parsing that cookie, then couldn't I just make a call to the frontend SDK, like
verifySession()
or whatever?
r
You can. There is a function called doesSessionExist in the session recipe on the frontend. You can poll that.
d
Ok, thanks. I think that would be easier. 😀
5 Views