hey Quick question is it possible somehow to allow multi use

Question

hey Quick question is it possible somehow to allow multi user signins Imagine Figma or Google where you can switch users anytime you want Technically it would be possible with JWTs and store them individually but I don t want to lose subdomain support With cookies it s a bit different since they have the same name and logging in another user would overwrite the previous one I was thinking about a middy middleware that would basically combine cookies from multiple users Combine them on the way out after and select the proper one on the way in before based on another header like x current user id What do you think about this or is there another way that I can achieve this Thanks

rp · Answer

Hey < legolas8911> this is possible Let me elaborate

rp · Answer

What you want to do is store an array of user ids in the access token payload and also store a field for current user in it

rp · Answer

This can be done via overriding the createNewSession function on the backend

rp · Answer

You also want to override that function to detect if a session already exists using the getSession function and then not creating a new session in case it exists already

rp · Answer

In case the session exists you want to modify the access token payload to add the new userId in the session and also set the current user id to that one

rp · Answer

In all your APIs instead of using session getUserId you want to instead use session getAccessTokenPayload currentUserId

rp · Answer

For switching between users you want to create an api that will modify the session payload s currentUserId to the one you want to switch to

rp · Answer

There are other approaches to this as well For example you could create a new session each time you want to switch users but also maintain that list of users you can switch to in that new session This way you can continue to use session getUserId in app your APIs The downside to this is that each time you switch users a new session is created The older one will eventually expire But this isn t such a big problem anyway

legolas8911 · Answer

hey < rp> thanks for the quick response I m logged in with user X I have the cookies for it all fine I now login with user Y I have the current cookie on the login request that belongs to user X so I can basically create a new session for user Y and adding X in the access token payload like you mentioned above All fine so far But my cookies for user X will be overwritten by the ones from Y isn t that right That means that as soon as the session for X expires it s gone no refresh for that user Only the last logged in user will have an autorefresh right Even if I have the user X userid in my Y session I can t just change the currentUserId on switch since that would be a security issue as I see it maybe user X was deleted in the meantime or something I ll need to make the user login with X again

legolas8911 · Answer

also using the Session getSession in createNewSession override seems tricky It expects header rid session or disable csrf but if I do that it breaks the login

rp · Answer

> But my cookies for user X will be overwritten by the ones from Y isn t that right Yes This is what you want > Only the last logged in user will have an autorefresh right Yes > Even if I have the user X userid in my Y session I can t just change the currentUserId on switch since that would be a security issue as I see it maybe user X was deleted in the meantime or something I ll need to make the user login with X agai So when you want to switch users you can do that by making an API that will Check if user X is in the session you add this to the access token payload when user Y logged in and check if X is not deleted Call the createNewSession with userId of `X` and putting Y in the access token payload so that you can switch to user Y later on if needed

rp · Answer

> using the Session getSession in createNewSession override seems tricky It expects header rid session or disable csrf but if I do that it breaks the login You should be able to call with without any issues how are you calling it And whats the error that you are getting

legolas8911 · Answer

const existingSession = await Session getSession input res event input res event on lambda using middy

legolas8911 · Answer

com supertokens t 2022 12 04T14 34 08 137Z message getSession Returning TRY REFRESH TOKEN because custom header rid was not passed file opt nodejs node modules supertokens node lib build recipe session sessionFunctions js 197 30 sdkVer 12 1 1

legolas8911 · Answer

com supertokens t 2022 12 04T14 34 08 138Z message errorHandler Error is from SuperTokens recipe Message anti csrf check failed Please pass rid session header in the request or set doAntiCsrfCheck to false for this API file opt nodejs node modules supertokens node lib build supertokens js 318 30 sdkVer 12 1 1

rp · Answer

can you try ``` await Session getSession input req input res ```

legolas8911 · Answer

there is no input res or input req

legolas8911 · Answer

wait just res

rp · Answer

oh sorry it should be `input options req` and `input options res`

legolas8911 · Answer

req does not exist

rp · Answer

also you should call it with optional session flag cause during first login there will be no session

legolas8911 · Answer

2022 12 04T14 34 07 984Z e7ba1234 91ee 4845 b0a6 4fe904ebed5d INFO SESSION INPUT res AWSResponse wrapperUsed true sendHTMLResponse Function anonymous setHeader Function anonymous setCookie Function anonymous setStatusCode Function anonymous sendJSONResponse Function anonymous sendResponse Function anonymous original version 2 0 routeKey $default rawPath signin rawQueryString cookies Array headers Object requestContext Object body formFields id email value lEMAIL id password value PASS isBase64Encoded false supertokens Object event version 2 0 routeKey $default rawPath signin rawQueryString cookies Array headers Object requestContext Object body formFields id email value EMAIL id password value PASS isBase64Encoded false supertokens Object statusCode 200 content responseSet false statusSet false userId UID accessTokenPayload st role v Array t 1670164447875 st perm v Array t 1670164447983 sessionData userContext default request AWSRequest

rp · Answer

ok right So what you may want to do is to call `getSession` function in the login API instead with `input options req` and `input options res`

rp · Answer

and then add the returned session object to `input userContext session = session`

rp · Answer

and then read `input userContext session` in the `createNewSession` override

rp · Answer

does this make sense

rp · Answer

oh wait actually a simpler way it to just do

rp · Answer

``` await getSession input userContext default request input res ```

rp · Answer

the request object is available in the userContext object

legolas8911 · Answer

Session getSession right

rp · Answer

yes

rp · Answer

and call it with optional session flag

rp · Answer

``` await getSession input userContext default request input res sessionRequired false ```

legolas8911 · Answer

deploying

legolas8911 · Answer

still getting 401 on login message try refresh token

rp · Answer

and the logs

legolas8911 · Answer

same getSession Returning TRY REFRESH TOKEN because custom header rid was not passed

legolas8911 · Answer

and if I pass rid I break login

rp · Answer

hmm thats weird the request object should have that `rid` header in it

legolas8911 · Answer

well it can t

rp · Answer

Can you console log out `input userContext default request`

legolas8911 · Answer

if I set it it breaks the login

legolas8911 · Answer

with rid set error The middleware couldn t serve the API path signin method post If this is an unexpected behaviour please create an issue here https github com supertokens supertokens node issues

rp · Answer

which recipe are you using

rp · Answer

and what rid are you setting

legolas8911 · Answer

message middleware Not handling because recipe doesn t handle request path or method Request path signin request method post

legolas8911 · Answer

thirdpartyemailpass

rp · Answer

set the `rid` as `thirdpartyemailpassword`

rp · Answer

and try

legolas8911 · Answer

heh this works

rp · Answer

ok nice

legolas8911 · Answer

let me check the logs if it found the session

legolas8911 · Answer

it did I have the session

legolas8911 · Answer

thanks

rp · Answer

nice

legolas8911 · Answer

to clarify without this change out of the box it worked without setting any rid header so I assumed for login it doesn t need to be set

rp · Answer

yea cause normally login doesn t call the `getSession` function

legolas8911 · Answer

I was making test requests from Paw not from a ST lib

rp · Answer

and `getSession` protects against CSRF using this `rid` header

legolas8911 · Answer

got it thanks