Hi I have a problem with getting 502 error for POST se

Question

Hi < rp> I have a problem with getting 502 error for POST session refresh so i want to resolve this problem can you help me

rp · Answer

Hey Does the core throw this error

IaS1506 · Answer

No its from nginx core throws 404

rp · Answer

Are you querying the core directly

IaS1506 · Answer

I use middleware in app session recipe has init So Post session signout works fine But for session refresh i get 404 It strange for me

IaS1506 · Answer

And bc of this nginx proxy answers with 502

rp · Answer

can you enable the backend debug logs and then query session refresh

IaS1506 · Answer

Hmm I can try

IaS1506 · Answer

And one another question I have done dinamic get origin from userContext can i put websiteDomain like this

rp · Answer

yea you can

IaS1506 · Answer

But how there is no userContext in supertokens init in appInfo

rp · Answer

oh i misunderstood You should set the websiteDomain to any one of the domains in this case doesn t really matter The websiteDomain is used to generate the reset password link for example which you are changing anyway

IaS1506 · Answer

Ah ok

IaS1506 · Answer

this is log for session refresh

rp · Answer

so the core is throwing a 500 error

IaS1506 · Answer

Core throw badtagexception do you see that

rp · Answer

yea Does that yield a 500 error from the core

IaS1506 · Answer

Maybe yes

IaS1506 · Answer

I dont really know

IaS1506 · Answer

Proxy returns 502 maybe bc of 500 on core

rp · Answer

Whats the value of the input refresh token

IaS1506 · Answer

one moment

IaS1506 · Answer

this is error when i make front access token expired

IaS1506 · Answer

unknown api is strange bc it use this api for other operations and its works fine

IaS1506 · Answer

srefresh token is 9hXe BscCVehdUCeT5M96CW56R6knQxP4R0rJJ JAX pTbdJuR0u2rXhAfJ0S+9wjpH9wb9Hlpi+QytOkXOYoCWiD7UDjwuV 7SXiI7CCwz cSG2IDKd 8xIgpb5p9WEpX+q6 7N9KSA52yGdyohwKTLKGi0HFjUUKKvfll4eUpFP+z518PgL5k6JhPfQLIXeGcYr2cKbKtZy6cqThdt8Morw 2U4Mz1KsBCepEanxiN9c7fp0EVXEM+tplJ4ac4c0wLgpcPTEIn0r5xn1JQ ea821154d86377cb94bb78908aa863ad6e3baabfabb2ffd0a065ddca5c0061c6 V2

IaS1506 · Answer

I describe my algo to make it clear

IaS1506 · Answer

i login with yandex for example in the frontend i see sFrontToken and sIRTFrontend I make sFrontToke expired and reload page So now it throws unknown api called And page is in infinity reloading Then I clear cookies and it sends me to login page I login with yandex and only on this moment it does the refresh session action and put me to the same page with new tokens And when i reload page I get my profile with a new session

IaS1506 · Answer

Do you understand what reasons can cause this problem

rp · Answer

So you are providing an invalid refresh token to the core This would yield the following response from the core ``` status UNAUTHORISED message javax crypto AEADBadTagException Tag mismatch ``` With a 200 status code Now the backend SDK would process this response and return a 401 to the frontend clearing the cookies and logging out the user

IaS1506 · Answer

Hmm I don t really understand why is refresh token is invalid and what i have to do to fix this problem

rp · Answer

well does this happen all the time on login Maybe something on your end is modifying the refresh token somehow

rp · Answer

like some proxy server in the middle

IaS1506 · Answer

The main problem is that it is happen every times

rp · Answer

then you should check your ngix maybe that s doing something weird to the headers

IaS1506 · Answer

2 month ago it has blocked by logout user from site when it starts spam 401 for session refresh

IaS1506 · Answer

Now I am trying to avoid so bad way of logic bc we go to release

rp · Answer

Maybe try removing Nginx and seeing if this type of error still happens

IaS1506 · Answer

And for this request srefresh token go as header

rp · Answer

to the core or to the backend SDK

IaS1506 · Answer

To core maybe im not sure

IaS1506 · Answer

Or to sdk

rp · Answer

to the sdk it goes as cookies from the frontend

rp · Answer

to the core it goes in JSON body

IaS1506 · Answer

it puts tokens without nginx for first time then i make accessToken expired then reload and access token and refresh token is gone So for the second time i met old problem

rp · Answer

If you make the access token expired a refresh should give you new tokens Is that not happening

IaS1506 · Answer

yes

IaS1506 · Answer

there no tokens after that

rp · Answer

What happens when you call the refresh api What s the input and what s the output

rp · Answer

Can you show me the request and response headers All of it Along with the response status code

IaS1506 · Answer

signin

IaS1506 · Answer

refresh

rp · Answer

The refresh token is not being sent by the browser

rp · Answer

What s the set cookie header response in sign in

rp · Answer

Can you show me the set cookie header in full

rp · Answer

In this one are these all the request headers

rp · Answer

Also what s weird is that the browser is not sending the refresh token in that request

rp · Answer

Does it have a preflight OPTIONS request What are the response headers in there

IaS1506 · Answer

moment

rp · Answer

And you have removed nginx completely right

IaS1506 · Answer

yes

IaS1506 · Answer

i go to host without enabled nginx

rp · Answer

How are you calling the refresh api

rp · Answer

Cause the access token is getting sent to it as well

rp · Answer

Can we get on a call

IaS1506 · Answer

yeah i will write when i can call

rp · Answer

I m free now

IaS1506 · Answer

Go

IaS1506 · Answer

now

rp · Answer

https us06web zoom us j 88568541270 pwd=cXJ1alJUYzRBRzNMd2NxUXloN0RXZz09

IaS1506 · Answer

ok it works now thank you very much Last thing is question about how i can clear frontend tokens when backend expires

rp · Answer

Do you mean that how to clear tokens on the frontend if the backend revokes the session without the frontend calling sign out explicitly

IaS1506 · Answer

Yeah

rp · Answer

you can t clear the frontend tokens that way they will auto clear when they try and refresh

IaS1506 · Answer

Ok