How is the sIdRefreshToken used? Is it essential? ...
# support-questions-legacyp
pitchash
03/30/2022, 12:33 PMHow is the sIdRefreshToken used? Is it essential? Docs don’t give much detail
r
rp_st
03/30/2022, 12:53 PMHey! This is used by the verifySession function to know if a session exists or not in case the access token is missing (since that might have expired).
If the sIdRefreshToken is there, the session does exist, in which case the function will return a try_refresh_token exception, else it will return an unauthorised exception.
The lifetime of the sIdRefreshToken == lifetime of refresh token. So if sIdRefreshToken is not there, it means the session is not there.
p
pitchash
03/30/2022, 12:54 PMThank you. That’s clear
pitchash
03/30/2022, 12:56 PMWhat does verify do if sIdRefreshToken cookie is not there but access token is and the access token is valid ?
r
rp_st
03/30/2022, 1:14 PMIt will give unauthorised
p
pitchash
03/30/2022, 1:16 PMRefresh token will also require sIdRefreshToken?
r
rp_st
03/30/2022, 1:17 PMyes
rp_st
03/30/2022, 1:17 PMboth should be sent automatically by the browser anyway
p
pitchash
03/30/2022, 1:18 PMI’m having to switch from cookies to retuning the tokens in the response bodies.
r
rp_st
03/30/2022, 1:19 PMOhh I see
rp_st
03/30/2022, 1:19 PMwhy though?
rp_st
03/30/2022, 1:19 PMthere is an example app that uses localstorage instead of cookies as the session token store: https://github.com/supertokens/supertokens-auth-react/tree/master/examples/with-localstorage
p
pitchash
03/30/2022, 1:20 PMSeveral developers on the fe web and mobile apps much prefer tokens from confirm step and refresh token step to be in the response body.
r
rp_st
03/30/2022, 1:20 PMHmmm i see.
p
pitchash
03/30/2022, 1:21 PMThe local storage example was a good starting point, but that also returns them in a header. Returning the tokens in the Json payload is a bit more hassle
r
rp_st
03/30/2022, 1:21 PMFair enough. Also, the verifySession may change the access token as well. So if that happens, you need to return the new access token to the frontend
rp_st
03/30/2022, 1:21 PMWhich means, any API that uses verifySession can potentially return a new access token
rp_st
03/30/2022, 1:22 PMSo i would really avoid using the response body for the tokens
p
pitchash
03/30/2022, 1:22 PMOk thanks. I didn’t realise that. I assumed only refresh token did that.
r
rp_st
03/30/2022, 1:23 PMverify does that whenever:
- The user update the access token payload in their API; OR
- The first verifySession call after a refresh token call changes the access token too
p
pitchash
03/30/2022, 1:24 PMDoes this mean that refresh tokens get extended on all api requests ?
r
rp_st
03/30/2022, 1:24 PMnope
rp_st
03/30/2022, 1:24 PMthe lifetime of the token is unaffected
15 Views