Hi I am using the HTTP API Flutter Project and have a proble

Question

Hi I am using the HTTP API Flutter Project and have a problem with the email verification I call the https auth user email verify token Endpoint and get back ` status EMAIL ALREADY VERIFIED ERROR ` But if I refresh the Sesseion afterwards https auth session refresh the FrontToken still has the verification set to false ```json up st ev v false ``` If I use the Server side api python to call `is email verified` directly i also get verified=`True` When does supertokens change the value in the FrontToken I noticed that the Token did refresh after I switched to a different user and back in the same window

rp · Answer

Hey < VonMorgen> which versions of the SDKs are you using

rp · Answer

The value in fronttoken changes whenever the access token payload changes

rp · Answer

So in this case it would happen if the users email is marked as unverified somehow

VonMorgen · Answer

i am using supertokens python 0 11 2

rp · Answer

The value of fronttoken also is set during refresh Based on the access token payload in the database

rp · Answer

What s the access token payload in the access token when this happens You can see that if you put the access token in JWT io

VonMorgen · Answer

```json ate 1667583850549 uid 166e07a4 50ea 4b56 9f80 8adbfb415fa8 up st ev t 1667576931314 v false supabase token <supabase token> ```

rp · Answer

Hmm So the access token payload didn t update in the db even though the claim was saying true before the refresh

rp · Answer

What happens when you call the is email verified api with the session

rp · Answer

Does the payload get set to true after that api call

VonMorgen · Answer

the GET users email verify returns ```json status OK isVerified true ```

VonMorgen · Answer

yeah now the refreshed token also contains ` v true`

rp · Answer

And now if you call the refresh api what s the value of the access token

VonMorgen · Answer

```json ate 1667584272679 uid 166e07a4 50ea 4b56 9f80 8adbfb415fa8 up st ev t 1667580595258 v true supabase token ```

rp · Answer

Right So this works

rp · Answer

I wonder why initially it was false post refresh

rp · Answer

Can you replicate that issue

VonMorgen · Answer

hm no I tried both with my app code and with postman but both times after the verify Email Request all tokens had the value correctly set to true

rp · Answer

Hmmmm

VonMorgen · Answer

the only thing i did differently is that i logged in with a different user before the issue occurred

VonMorgen · Answer

i will try that again

rp · Answer

I didn t understand the scenario

rp · Answer

Hey < VonMorgen> were you able to replicate the issue

VonMorgen · Answer

yeah finally 0 unverify user via backend 1 clear cookies in browser 2 clear cookies in postman 3 sign in via postman => verified= false 4 send verification email in postman 5 open link in browser and verify email there 6 check via server side sdk => verified true 7 refresh in postman => verified false < expected true 8 get verify email in postman => verified true 9 refresh in postman => verified true

rp · Answer

I see So the session refresh doesn t update the claims It only creates new tokens

rp · Answer

In step 5 do you open the link on the same browser as the one in which the session exists And if yes once the api is called to verify the session does the session claim gets update to verified true

rp · Answer

Also the refresh in postman is for another session right

rp · Answer

I mean postman has its own session and the browser has its own session

VonMorgen · Answer

no i cleared all cookies in the browser so that it calls the verify email endpoint without a session

rp · Answer

I see In that case this is the expected behaviour A call to the API for is session verified will update the claims in the session as you had seen before

rp · Answer

We should and will make this change to also update the claims in the session in the API for generating email verification token in case it s already verified

VonMorgen · Answer

yeah i use postman as if it was the standard client Usecase User is signed in on device A postman Requests an verification email User recieves the email on device B firefox and opens the link on that device The browser says email verified and the user goes back to device A

rp · Answer

yea in that case when device A checks the session for if email is verified it will return `false` Then the client should rediect the user to the email verification screen in which the first step should be to call the API to check if the email is verified or not and this would update the session claim With the new session claim the frontend should just redirect the user back to their previous screen

rp · Answer

But yea we should also update the claim when the genertae email verification token API is called

VonMorgen · Answer

ok thank you for explaining that makes sense

VonMorgen · Answer

but if a user signs in on a new device the claims are correct

rp · Answer

yes

VonMorgen · Answer

perfect

rp · Answer

Are you using our pre built UI

rp · Answer

or custom UI

VonMorgen · Answer

no custom ui

VonMorgen · Answer

i am using flutter

rp · Answer

Ah i see

VonMorgen · Answer

so i am implementing basically the whole sdk myself

rp · Answer

yea makes sense