Anyone having an idea where a `SessionError INVALID CLAIMS`

Question

Anyone having an idea where a `SessionError INVALID CLAIMS` is coming from I get this after logging in with email + password The stack trace is not that helpful ``` SessionError INVALID CLAIMS at Session app node modules supertokens node lib build recipe session sessionClass js 146 27 at Generator next at fulfilled app node modules supertokens node lib build recipe session sessionClass js 15 36 at processTicksAndRejections node internal process task queues 96 5 type INVALID CLAIMS payload Object errMagic ndskajfasndlfkj435234krjdsa fromRecipe session ``` On a site note is there any plans for removing the async > generator transform Async functions are supported since a long time now and covered by all LTS versions https node green ES2017 features async functions

rp · Answer

hey < n1ru4l> can you print out the value of the `payload`

rp · Answer

> On a site note is there any plans for removing the async > generator transform Could you please open an issue about this on our github We will have a look

n1ru4l · Answer

issue https github com supertokens supertokens node issues 413

n1ru4l · Answer

let me see how i can print the payload it is from staging logs

rp · Answer

thanks

n1ru4l · Answer

Is the payload safe to be JSON stringified

rp · Answer

yes It is

n1ru4l · Answer

okay deploying soon i will let you know

rp · Answer

thanks

n1ru4l · Answer

``` debug SessionError id st ev reason message wrong value expectedValue true actualValue false ```

n1ru4l · Answer

` id st ev reason message wrong value expectedValue true actualValue false ` is the payload

rp · Answer

I see

rp · Answer

Have you initilaised email verification recipe on the backend but not on the frontend

n1ru4l · Answer

it should be initialised for sure it happens in the code before

n1ru4l · Answer

``` const backendConfig = await import config supertokens backend const SupertokensNode = await import supertokens node const Session = await import supertokens node recipe session SupertokensNode init backendConfig let session SessionContainerInterface | undefined try console log debug before Session getSession session = await Session getSession context req context res sessionRequired false console log debug after Session getSession catch e console log debug oh no it throws if payload in e as any console log debug SessionError JSON stringify e as any payload throw e ```

n1ru4l · Answer

oh wait I misread your question

rp · Answer

basically this is happening cause the user s email is not verified and on the backend you have done emailverification init > which essentially requires that the user s email is verified for session verification to succeed

rp · Answer

If you want to change that either remove emailverification init on the backend or implement an email verification flow on the frontend or set the emailverfiication on the backend to be in optional mode Details of this can be found in our docs in the email verification section

n1ru4l · Answer

no it is required on both

n1ru4l · Answer

ahhh i see

n1ru4l · Answer

previously this was only verified on the frontend i remember that i had a question related to this

rp · Answer

yeaaa So that changed in the new releases

rp · Answer

if you are using our pre built UI on the frontend then post sign up the frontend SDK should redirect you to the email verification page If you are not using our pre built UI you will have to make that flow

n1ru4l · Answer

okay so I kind of have to change my implementation to redirect to the verify email screen in that case

rp · Answer

yes

rp · Answer

post sign up

n1ru4l · Answer

we use the prebuilt ui

rp · Answer

oh the pre built UI should redirect post sign up on its own

rp · Answer

have you updated to the newer version of the frontend SDK

n1ru4l · Answer

i think we have some custom logic for redirecting to the latest visited url instead

rp · Answer

Hmm That s in the getRedirectionUrl function

rp · Answer

cause that function is only called after the email verification is done in case email verification is required which it is in this case

n1ru4l · Answer

trying to reproduce this issue locally now

n1ru4l · Answer

my first feedback thought this error shouldn t be that cryptic

rp · Answer

fair enough

rp · Answer

the payload was printed out as ` Object ` which is why it was hard to decipher But we can add some more info to it to make it easier

n1ru4l · Answer

``` supertokens auth react 0 27 1 supertokens node 12 0 5 supertokens js override 0 0 4 supertokens website 14 0 2 ``` so these are definetly the latest version I guess the issue here is that we are doing the validation before anything happens on the frontend within the server side props handler thus we should catch this case there and in that case redirect to the confirm email form

rp · Answer

Is the server side getSession running on all pages Even the email verification page

n1ru4l · Answer

it runs on

n1ru4l · Answer

and after login i am kind of redirected there

n1ru4l · Answer

or if i am already logged in and just visiting that page

n1ru4l · Answer

so in any case i wanna catch this and redirect to the form i guess

n1ru4l · Answer

we have some helper function ``` Utility for protecting a server side props function with session handling Redirects user to the login page in case there is no session export function withSessionProtection handlerFn GetServerSideProps = defaultHandler const getServerSideProps GetServerSideProps = async context => const result = await serverSidePropsSessionHandling context if result return result return handlerFn context return getServerSideProps ```

rp · Answer

Yea You should do that

rp · Answer

If you see this link https supertokens com docs thirdpartyemailpassword nextjs session verification in ssr

rp · Answer

it has the `else if err type === Session Error UNAUTHORISED || err type === Session Error INVALID CLAIMS ` line

rp · Answer

so in case it s INVALID CLAIMS you can send a response to the frontend that indicates you need to redirect to the email verification page

n1ru4l · Answer

i see does `err type === Session Error INVALID CLAIMS ` always mean email verification missing

rp · Answer

depends on the claims you have added

rp · Answer

For examlpe the user roles adds its claims too

rp · Answer

thats where the payload comes into the picture

n1ru4l · Answer

and what was the url of the email page

rp · Answer

if the payload array contains an object with the `id` `st ev` it s cause of email verification failure

rp · Answer

that being said you should not have run into this issue at all post sign in the SDK should have redirected you to the email verification page

rp · Answer

why is that not happening

n1ru4l · Answer

apparently it does not and i cannot see anything fishy tbh

rp · Answer

hmm That s really strange

rp · Answer

I ll investigate

n1ru4l · Answer

it should be on the frontend config right

rp · Answer

emailverification init

n1ru4l · Answer

dont wanna let you search for sth that i might have broken in user code

rp · Answer

Yea you need to add that to the frontend config s recipeList

n1ru4l · Answer

``` return appInfo appInfo recipeList ThirdPartyEmailPasswordReact init signInAndUpFeature providers override env auth organizationOIDC getOIDCOverrides undefined EmailVerification init mode env auth requireEmailVerification REQUIRED OPTIONAL SessionReact init ```

n1ru4l · Answer

mode is definetly set to required

rp · Answer

hmm

rp · Answer

let me check

rp · Answer

Oh i think that s intentional from our side my bad

rp · Answer

We only do redirection post sign up

rp · Answer

Or when <SessionAuth> is run on the frontend

rp · Answer

but in your case the getServerSideProps runs before

n1ru4l · Answer

yeah so the solution you proposed with the redirect makes sense

rp · Answer

One simple solution to this would be to simply make the getSession function not check for claims at all in the getServerSideProps function

rp · Answer

and then it will pass and the SessionAuth on ther frontend will detect the failed claim and redirect on its own

n1ru4l · Answer

I think the redirect approach is just fine tbh

rp · Answer

Alright

n1ru4l · Answer

it makes sense the session is not valid unless the email is verified

rp · Answer

but regardless in case you change your mind the way you can do the other thing is to call getSession like this ``` await Session getSession context req context res overrideGlobalClaimValidators => return ```

n1ru4l · Answer

In that I case I think it is kind of more elegant to already start the redirect on the backend compared to doing it on the frontend

n1ru4l · Answer

Thanks again

rp · Answer

fair enough

rp · Answer

also keep in mind that this is an edge case this situation will only happen if a user signed up and didn t do email verification and then tries to sign in again after

rp · Answer

or if you change the config of email verification mode over time from REQUIRED to OPTIONAL and then back