Hello, im not sure if im doing something wrong of of its maybe a bug. Im using Nextjs. If i call my ...

ctrick1337

10/26/2022, 10:14 PM

Hello, im not sure if im doing something wrong of of its maybe a bug. Im using Nextjs. If i call my api that revoke All Session for the current user (await Session.revokeAllSessionsForUser(userId);) I can still use the frontend and make other api calls. Frontend is protected with SessionAuth and api with superTokensNextWrapper/verifySession. ACCESS_TOKEN_BLACKLISTING is enabled. Why i can still use the frontend after revoking all sessions. I want to logout all devices of the user

rp_st

10/27/2022, 5:03 AM

hey @ctrick1337

rp_st

10/27/2022, 5:04 AM

how have you enabled ACCESS_TOKEN_BLACKLISTING?

ctrick1337

10/27/2022, 6:52 AM

Hey @rp_st

ctrick1337

10/27/2022, 6:53 AM

I added ACCESS_TOKEN_BLACKLISTING to the env in my docker compose file supertokens: image: registry.supertokens.io/supertokens/supertokens-postgresql depends_on: - db ports: - 3567:3567 environment: POSTGRESQL_CONNECTION_URI: "postgresql://supertokens_user:somePassword@db:5432/supertokens" ACCESS_TOKEN_BLACKLISTING: "true"

ctrick1337

10/27/2022, 6:53 AM

i checked the config.yaml inside the docker container. ACCESS_TOKEN_BLACKLISTING is set to true

rp_st

10/27/2022, 7:21 AM

hmm. Can you call the handshake API (https://app.swaggerhub.com/apis/supertokens/CDI/2.16.2#/Session%20Recipe/sessionHandshake) on the core instance and show me the result from it?

ctrick1337

10/27/2022, 7:34 AM

{"data":{"status":"OK","jwtSigningPublicKey":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr00Y6Hvltt4vdpwuvpwZjzD4S4/xffXWQaKDZn0vbvo6ZNEcwbA1clsW2FHAP+rVSfMkJWQwLTawdU012cDunGFy276b60fCl9Qa2dl0wXNb5TB/sxYuJZEOkr8lZy79seXoIyjssIHAMZYXvNW7wOSPcCTK9ovPsMbT8V/PSbkAwiVC+5gwahnwaKxY3Fq0zmWCc7qB3xu/V2PXdWWjNp3sb8lzx0vVsA94wWVPflK7wSMBl8E7oZ5i+I/vNS6f0lb69m9kQNae44tbZ6Qy4xfGrEHSAU5sayvjkAI/RzwoMDXu6Y1cryFuCAZKqVAceVexLwU4YX+Db6IzjKWqPQIDAQAB","jwtSigningPublicKeyExpiryTime":1667424951986,"jwtSigningPublicKeyList":[{"publicKey":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr00Y6Hvltt4vdpwuvpwZjzD4S4/xffXWQaKDZn0vbvo6ZNEcwbA1clsW2FHAP+rVSfMkJWQwLTawdU012cDunGFy276b60fCl9Qa2dl0wXNb5TB/sxYuJZEOkr8lZy79seXoIyjssIHAMZYXvNW7wOSPcCTK9ovPsMbT8V/PSbkAwiVC+5gwahnwaKxY3Fq0zmWCc7qB3xu/V2PXdWWjNp3sb8lzx0vVsA94wWVPflK7wSMBl8E7oZ5i+I/vNS6f0lb69m9kQNae44tbZ6Qy4xfGrEHSAU5sayvjkAI/RzwoMDXu6Y1cryFuCAZKqVAceVexLwU4YX+Db6IzjKWqPQIDAQAB","expiryTime":1667432151986,"createdAt":1666820151986}],"accessTokenBlacklistingEnabled":true,"accessTokenValidity":3600000,"refreshTokenValidity":8640000000}}

rp_st

10/27/2022, 7:40 AM

hmm. So the

accessTokenBlacklistingEnabled

true

rp_st

10/27/2022, 7:40 AM

when you call revoke session for user, do the sessions get cleared in the db?

ctrick1337

10/27/2022, 7:40 AM

i never checked in the db of supertokens

rp_st

10/27/2022, 7:41 AM

maybe you should.

rp_st

10/27/2022, 7:41 AM

and make sure that the userId you are passing to that function is correct.

ctrick1337

10/27/2022, 7:42 AM

What i can tell. I get an empty array from Session.getAllSessionHandlesForUser(userId); after using Session.revokeAllSessionsForUser(userId);

rp_st

10/27/2022, 7:42 AM

hmm. And before calling

revokeAllSessionsForUser

, if you call

getAllSessionHandlesForUser

, it wasn't an empty array?

ctrick1337

10/27/2022, 7:44 AM

I try to explain it a bit more detailed. I sign in twice with the same user in my browser. 1 signin in NOT private mode and 1 signin in private mode of chrome The with 1 user i call my /api/revoke-all-sessions This api endpoint do a await Session.revokeAllSessionsForUser(userId);

ctrick1337

10/27/2022, 7:44 AM

yes

rp_st

10/27/2022, 7:45 AM

I see.

rp_st

10/27/2022, 7:45 AM

Can you open an issue about this on our github? We will have a look at it asap

ctrick1337

10/27/2022, 7:47 AM

rp_st

10/27/2022, 7:48 AM

oh and one thing to make sure if that you have to restart the next app after making the config change - did you do that?

ctrick1337

10/27/2022, 7:48 AM

ctrick1337

10/27/2022, 7:48 AM

yes i cancelled my app. And restert it with yarn dev

rp_st

10/27/2022, 7:48 AM

hmm ok

rp_st

10/27/2022, 7:49 AM

If you could just please open a github issue about this, it would be great

ctrick1337

10/27/2022, 7:49 AM

thats my api. On first request i get my session handles. And on second they are empty

ctrick1337

10/27/2022, 7:49 AM

but i still have a session

ctrick1337

10/27/2022, 7:49 AM

Yes! 🙂 i just wnated to be sure. Before openeing an github issue. I don't want to get insulted 😄

rp_st

10/27/2022, 7:50 AM

oh don't worry about it. Worst case, if it's not a bug, the issue will just be closed 🙂

ctrick1337

10/27/2022, 7:50 AM

Maybe i should test with the hosted core system?

ctrick1337

10/27/2022, 7:50 AM

Possibly a docker bug?

ctrick1337

10/27/2022, 7:52 AM

on which repo should i open the issue?

rp_st

10/27/2022, 7:55 AM

it's not a docker bug for sure

rp_st

10/27/2022, 7:55 AM

you can open an issue in the supertokens-node repo

ctrick1337

10/27/2022, 7:58 AM

i tested with the hosted version. Now it works 😄

rp_st

10/27/2022, 7:59 AM

hmm. Thats very strange

rp_st

10/27/2022, 7:59 AM

cause the hosted version uses the same docker image as the self hosted one

2 Views

Previous Next

SuperTokens.com

SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).