Hey guys, did the implementation of sessionRequire...
# support-questions-legacyn
nadilas
05/22/2022, 2:29 PMHey guys, did the implementation of sessionRequired change in supertokens-node@9.2.0?
Even though I had set it to false it now throws a 401 Unauthorized for public routes
return await verifySession({sessionRequired: false})(ctx.req as any, ctx.res as any, next)r
rp_st
05/22/2022, 2:31 PMHuh.. that’s weird. Nothing has changed regarding this
rp_st
05/22/2022, 2:31 PMHave you tried a previous version and that worked?
n
nadilas
05/22/2022, 2:33 PMMhm, good point, not yet. It was working up until the today.
r
rp_st
05/22/2022, 2:33 PMCan you enable debug logs and show me the output?
n
nadilas
05/22/2022, 2:33 PMI'll try downgrading one minor. It's not a blocking point, I just moved the middleware logic one layer down to my protected routes, now it can actually check with sessionRequired: true, but still I thought it was weird
nadilas
05/22/2022, 2:34 PMSure, let me move things back
nadilas
05/22/2022, 2:34 PMHow do you enable debug logs again? 😄
r
rp_st
05/22/2022, 2:34 PMAdd env var like DEBUG=com.supertokens node index.js
n
nadilas
05/22/2022, 2:36 PMOne sec
nadilas
05/22/2022, 2:44 PMSo your explanation tells me, even though a session is not required per my parameter, having an expired access_token present in the call causes the verification to fail
nadilas
05/22/2022, 2:44 PM?
r
rp_st
05/22/2022, 2:44 PMYes. Cause technically, the session does exist. The user is still logged in
n
nadilas
05/22/2022, 2:45 PMOooooh
nadilas
05/22/2022, 2:45 PMSo if I clean the cookies, the public route will work again having no expired token and no active session
nadilas
05/22/2022, 2:45 PM?
nadilas
05/22/2022, 2:45 PMIt was a hypothetical question, it of course means that 😄 and it does work
r
rp_st
05/22/2022, 2:46 PMTheir refresh token is still valid.
rp_st
05/22/2022, 2:46 PMSo it just needs session refreshing
rp_st
05/22/2022, 2:46 PMYup. If you clear just the sIdRefresh cookie, it will not return a 401
n
nadilas
05/22/2022, 2:47 PMI was supposed to be after a logout, but on local dev, I probably messed up the states or restarts and got stuck
r
rp_st
05/22/2022, 2:48 PMYeaaaa. That’s possible
n
nadilas
05/22/2022, 2:48 PMI guarded the app with
sessionRecipe.doesSessionExist()nadilas
05/22/2022, 2:49 PMis there a helper method (or maybe signout?) I can call for easy cleanup of the cookies if
sessionRecipe.doesSessionExist()r
rp_st
05/22/2022, 2:49 PMI see. Yea. State is messed up.
rp_st
05/22/2022, 2:49 PMWell. The state you somehow reached shouldn’t be possible unless manually cookies are cleared incorrectly.
rp_st
05/22/2022, 2:50 PMSo there isn’t such a helper
n
nadilas
05/22/2022, 2:51 PMRight, if this state cannot happen on prod then I'm fine, I know now how to get out of it
nadilas
05/22/2022, 2:51 PMthanks 👍
r
rp_st
05/22/2022, 3:06 PM👍