Hi guys I ve come across a pretty strange behavior I m using

Question

Hi guys I ve come across a pretty strange behavior I m using the SDK in a react native app In order to maintain the session state i routinely check SuperTokens doesSessionExist and with that answer go forward with an authorized unauthorized user What i have discovered is that when the session expires the method doesSessionExist still resolves true

rp · Answer

hey < Axel Jönsson>

Axel Jönsson · Answer

Yo

rp · Answer

when the session expires meaning that the access token has expired or that the refresh token has expired too

Axel Jönsson · Answer

no its the access token Because i can run the attemptRefreshingSession method instead of doesSessionExist as a work around

rp · Answer

right yea So in this case a session does exist It s just that the access token has expired

rp · Answer

a session fails to exist when the refresh token was revoked or has expired

Axel Jönsson · Answer

ok that explains it actually what is your recommendation if i just want a simple way to check if a session is valid

Axel Jönsson · Answer

Should i go for getUserId if it is an empty string the session is false or something like that

rp · Answer

not really You shouldn t have to worry about access token expiration Just use the functions freely Refreshing happens on its own

Axel Jönsson · Answer

huh that sparks a couple of questions Refreshing happens on its own

rp · Answer

yea Are you using axios

rp · Answer

if so you need to add our axios interceptors to your axios instance

rp · Answer

and then it will do auto refresh when you make an API call

Axel Jönsson · Answer

ooh ok No i have a simple fetch call right now Was hoping to make use of your coming fix to intercept apollo requests

rp · Answer

fetch interception also should happen on its own

Axel Jönsson · Answer

hmm

rp · Answer

as long as you called session init

Axel Jönsson · Answer

yep

Axel Jönsson · Answer

wait session init

rp · Answer

in the request that you make what are all the headers that sent in the request

rp · Answer

> wait session init Oh sorry

rp · Answer

just supertokens init

Axel Jönsson · Answer

ye

Axel Jönsson · Answer

hehe

Axel Jönsson · Answer

with a google login i send

Axel Jönsson · Answer

headers Content Type application json rid emailpassword

rp · Answer

right So interception is happening

rp · Answer

oh wait no

rp · Answer

i mean can you show me the request headers for an API call to one of your APIs

Axel Jönsson · Answer

yeah

rp · Answer

that you call using fetch

rp · Answer

post login

rp · Answer

right So interception is happening

rp · Answer

now if the API returns 401 does it not call the refresh APi

Axel Jönsson · Answer

no i ve tried it locally with an expiry timer on 1 min And i have to manually call refresh in order to get it to do exactly that

rp · Answer

hmm Does the API return a 401 if the access token has expired

Axel Jönsson · Answer

call attemptRefreshing

Axel Jönsson · Answer

hmm that i haven t tried actually

Axel Jönsson · Answer

or checked rather

rp · Answer

so you should let the access token expire and then call an API that uses verifySession That API should return a 401 which should trigger a refresh API call on its own

rp · Answer

so you don t need to call attemptRefreshing

Axel Jönsson · Answer

I have to check how it is done in the backend It s not me who set that part up

rp · Answer

right All you should see is that the API returns a 401 when access token has expired or is missing

Axel Jönsson · Answer

aight give me a couple of mins

Axel Jönsson · Answer

have to set things up locally

Axel Jönsson · Answer

ok

Axel Jönsson · Answer

so i did not get a 401 back

Axel Jönsson · Answer

i only got an error from hasura saying code access denied

Axel Jönsson · Answer

so maybe it is the hasura middle layer interrupting me again

Axel Jönsson · Answer

But i gues that that is good enough code access denied is the translation of 401 so i can handle that error in the client side

rp · Answer

yea but it s better for the backend to send 401

rp · Answer

you shouldn t have to handle refreshing on your frontend

Axel Jönsson · Answer

I fully agree but with the requests going through hasura i dont really see a better way for now

Axel Jönsson · Answer

But at least now i know how it works

Axel Jönsson · Answer

So a huge thanks for the help today I

Axel Jönsson · Answer

You ll probably hear from me again sometime Merry christmas

rp · Answer

sounds good