Some feedback -- if a user hits the /auth/signout route WITHOUT the right cookies (i.e. missing a refresh token cookie, or no cookies at all) the backend will 200 OK. If you enable debug logs it'll show something is amiss, but the 200 OK is very misleading. Similar on the frontend -- it'd be nice to get verbose output upon misconfigured

SameSite

and cookies not being stored properly. Cost 2-3 hours of dev time spinning wheels yesterday in local environment trying to figure that one out. Signout was simply doing nothing and it wasn't obvious what was broken.

thanks for the feedback 🙂 What do you think would be appropriate response for the signout route in this case? I think responding with unauthorized to a signout request is strange. I'll check if we can detect such misconfiguration, but the difficulty with this is that the frontend can't directly detect that anything went wrong - they are httponly cookies, while the backend just doesn't get them which is the same as someone without a session calling these endpoints.

I'd think 400 Bad Request maybe?

Hmm, I'm not sure if that fits 100%, but we'll discuss this internally. It may be a good solution to distinguish this case.

Thanks for taking the feedback and for all your hard work on a great product!

The frontend doesn't really store the refresh token. If the samesite is misconfigured the browser just refuses to handle that part of the response headers. We can't really check.

My one other feedback - on the backend, in NodeJS -- it's not obvious what the recipe lifecycle is, especilaly in what order which api/function overrides occur. I had to figure it out via trial and error. It'd also be nice if supertokens gave a convenient way to share state between override functions, I managed to do it via the Express.Request object, but an out of the box recommendation would've saved time.

There is one: https://supertokens.com/docs/passwordless/advanced-customizations/user-context

Ah, I totally didn't see that article. Is it available on all the recipe guides? And re: flowchart - I think that's a great idea!

it is 🙂