Can I use verifySession in a way that the route is also accessible by users without a session? I th...

leolurchig

01/21/2023, 4:22 PM

Can I use verifySession in a way that the route is also accessible by users without a session? I thought

verifySession({ sessionRequired: false })

would do the trick, but requests without a session get a 401. This is a problem for me, because I'm using https://telefunc.com for client <> server communication. The tool uses one route, whereas some requests need data from a possible existing session and some don't. Is there maybe another way without using verifySession?

rp_st

01/21/2023, 4:23 PM

Hey. Using sessionRequired: false is the correct way

rp_st

01/21/2023, 4:24 PM

The only time this returns a 401 is when a user has a session, but their access token has expired

rp_st

01/21/2023, 4:24 PM

Therefore the session needs to be refreshed

rp_st

01/21/2023, 4:24 PM

As opposed to a user who doesn’t have a session at all. In this case it will allow the api to run except that the session object is undefined

leolurchig

01/21/2023, 4:32 PM

Hmm ok I'll investigate a bit more

leolurchig

01/21/2023, 4:32 PM

Thanks for all the help in the last 2 days!!

leolurchig

01/21/2023, 5:22 PM

Sometimes the automatic refreshing of the accessToken works, and sometimes I just get back a 401. Can't really work out, what the problem is. Just really unpredictable. To test better, I decreased the accessToken lifetime to 15s. And on sometimes the refreshing works and I can have minutelong session, but sometimes not. Noticed, that Session.doesSessionExist returns false immediately after the session creation (when the 15s token is still valid). What could be the cause for that?

rp_st

01/21/2023, 5:47 PM

which frontend sdk of ours are you using?

leolurchig

01/21/2023, 5:48 PM

I'm using supertokens-web-js

rp_st

01/21/2023, 5:48 PM

right. Can i see the request and response headers for the sign in API call? Chrome screenshot will do

leolurchig

01/21/2023, 5:51 PM

Yes, I'll prepare them. But I just found something: When I create the new session and wait, until the accessToken expires. Then sIRTFrontend is set to remove. The accessToken also gets removed. When I delete the sIRTFrontend cookie and refresh the page the refreshing works. It also never stops working. Not even after multiple refreshes. What functionality sets the sIRTFrontend cookie?

rp_st

01/21/2023, 5:52 PM

we add interceptors to your networking lib and when the interceptor detects that session tokens are returned, it sets the correct value for sIRTFrontend

leolurchig

01/21/2023, 5:54 PM

What does it mean when it's set to remove?

rp_st

01/21/2023, 5:55 PM

it means that the frontend thinks that no session exists.

leolurchig

01/21/2023, 5:57 PM

when is that supposed to happen?

rp_st

01/21/2023, 5:58 PM

when you call the sign in function from the frontend.

rp_st

01/21/2023, 5:58 PM

The API that returns session tokens

leolurchig

01/21/2023, 6:02 PM

I'm not doing that. My current flow looks like the following: I sign into github with my own implementation of the OAuth flow, which redirects the user to a new tab. I create the session on the server using createSession() and add the oauth token to the sessionData. The new tab is closed and the session exists for the livetime of the accessToken

rp_st

01/21/2023, 6:03 PM

Right. So the api that calls createNewSession, I want to see the response and request headers for that

leolurchig

01/21/2023, 6:04 PM

The session creation is happening in the express backend. The Frontend get's to know that the user is logged in because of the values the telefunc functions return

rp_st

01/21/2023, 6:05 PM

I’m confused. Doesn’t the frontend call the express backend api which creates the new session?

leolurchig

01/21/2023, 6:06 PM

Yes but not through the supertokens sdk

rp_st

01/21/2023, 6:06 PM

That’s fine

rp_st

01/21/2023, 6:06 PM

So whatever that api call is, I want to see the request and response headers of that

leolurchig

01/21/2023, 6:06 PM

Alright

leolurchig

01/21/2023, 6:12 PM

Copy code

{
      "params": {
        "headers": [
          "Host: localhost:3000",
          "Connection: keep-alive",
          "Upgrade-Insecure-Requests: 1",
          "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36",
          "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
          "Sec-Fetch-Site: cross-site",
          "Sec-Fetch-Mode: navigate",
          "Sec-Fetch-User: ?1",
          "Sec-Fetch-Dest: document",
          "sec-ch-ua: \"Not_A Brand\";v=\"99\", \"Google Chrome\";v=\"109\", \"Chromium\";v=\"109\"",
          "sec-ch-ua-mobile: ?0",
          "sec-ch-ua-platform: \"macOS\"",
          "Accept-Encoding: gzip, deflate, br",
          "Accept-Language: de, en;q=0.9",
          "Cookie: sIRTFrontend=remove"
        ],
        "line": "GET /services/auth/github-oauth-callback?code=29bba76e378dbfb47e9c HTTP/1.1\r\n"
      },

leolurchig

01/21/2023, 6:12 PM

The request

rp_st

01/21/2023, 6:12 PM

Can u show me the screenshot on chrome?

leolurchig

01/21/2023, 6:12 PM

bit tricky because of the new tab opening thing

leolurchig

01/21/2023, 6:14 PM

got it to work

rp_st

01/21/2023, 6:14 PM

Hmm. This already has the access token set in cookies.

rp_st

01/21/2023, 6:14 PM

So I’m not sure what you are doing

leolurchig

01/21/2023, 6:17 PM

ok sorry wrong one

rp_st

01/21/2023, 6:18 PM

So it seems that our interceptor is not applied to this api call. What’s the domain for this api call? And what’s the value of apiDomain set on the frontend?

leolurchig

01/21/2023, 6:20 PM

uhh ok that sounds like a really good hint

leolurchig

01/21/2023, 6:21 PM

I set the frontend and backend api path to /session

rp_st

01/21/2023, 6:21 PM

What about the apiDomain?

leolurchig

01/21/2023, 6:21 PM

My api routes are at /

rp_st

01/21/2023, 6:21 PM

That’s not the issue

leolurchig

01/21/2023, 6:21 PM

apiDomain is http://localhost:3000

rp_st

01/21/2023, 6:22 PM

As long as you have the same apiBasePath on the backend and frontend

leolurchig

01/21/2023, 6:22 PM

(in the frontend location.origin)

rp_st

01/21/2023, 6:22 PM

And what is the value of location.origin?

rp_st

01/21/2023, 6:22 PM

And which api are you calling? The domain of the api

leolurchig

01/21/2023, 6:22 PM

http://localhost:3000

rp_st

01/21/2023, 6:22 PM

Even on the callback screen, the location.origin is localhost:3000?

leolurchig

01/21/2023, 6:24 PM

I set it to "http://localhost:3000" now. Should have been that with location.origin, but I'll test with the fixed string

rp_st

01/21/2023, 6:25 PM

You also need to make sure that you are calling supertokens.init on the frontend in the callback page before the api call is made

leolurchig

01/21/2023, 6:25 PM

That is happening

leolurchig

01/21/2023, 6:25 PM

I got an error when that didn't happen

rp_st

01/21/2023, 6:25 PM

Can you enable frontend debug logs and show me the output when the api call is made?

leolurchig

01/21/2023, 6:27 PM

yes

leolurchig

01/21/2023, 6:30 PM

https://hastebin.com/ipayopares.properties

rp_st

01/21/2023, 6:33 PM

Can you send me the logs that are generated just during the api call?

leolurchig

01/21/2023, 6:35 PM

The user get's redirected to my app after successful github authentication. In the request of that page the session gets created

rp_st

01/21/2023, 6:35 PM

There is a preserve log button on chrome

rp_st

01/21/2023, 6:36 PM

Maybe go through this list first before I can help more 🙂

rp_st

01/21/2023, 6:36 PM

https://github.com/supertokens/supertokens-website/issues/68

rp_st

01/21/2023, 6:37 PM

Intuitively, it seems that you are not calling supertokens.init before making the api call.

rp_st

01/21/2023, 6:37 PM

But I may be wrong.

leolurchig

01/21/2023, 6:37 PM

Ok thanks, I'll work through that

leolurchig

01/21/2023, 6:38 PM

So could the problem be that the session get's created in the page request?

leolurchig

01/21/2023, 6:38 PM

The frontend can't be initialized before

rp_st

01/21/2023, 6:38 PM

It gets created in the api call you are making

rp_st

01/21/2023, 6:39 PM

The problem is that our interceptors are not being applied to the api call

rp_st

01/21/2023, 6:39 PM

This happens cause of misconfiguration of apiDomain vs the url that you are querying

rp_st

01/21/2023, 6:39 PM

Or cause you have not called supertokens.init on the app yet

rp_st

01/21/2023, 6:40 PM

If you have specific questions, I’d be happy to help. I feel like I have spent enough time debugging with you and the GitHub issue about exists already.

leolurchig

01/21/2023, 6:40 PM

Yes, you're right

leolurchig

01/21/2023, 6:40 PM

Thanks a lot man!

leolurchig

01/22/2023, 2:57 PM

FYI: You've been right, I created the session on a "API-only" route. The user got directly redirected to that route and on that route no SuperTokens.init() call was made. I'm creating the session now with a fetch call from the frontend even before it is needed and before the oauth redirection cascade. Everything works as expected now 🙂 Can the frontend also recognise that a session is created if this creation is not triggered by a fetch call from the frontend? Would it work if I redirect the user to a new page and the session get's created in that page request (so not by calling an API endpoint and so for not utilizing the fetch interceptor)? Supertokens would only be initialized, after the browser processes the response. But the response would include all necessary headers.

rp_st

01/22/2023, 3:10 PM

Yes. That can work, if on the frontend, you call the Session.attemptRefreshSession function when the page loads (I think the name of the function is that, but if not, it’s similar)

leolurchig

01/22/2023, 5:03 PM

Alright, thanks 👍

leolurchig

01/22/2023, 6:40 PM

Everything works as expected now, in Chrome... Safari seems to have problems. Can my multi tab oauth flow be a problem in Safari? I'm creating the session in one tab and it survives refreshes. When I navigate to the oauth provider in a new tab and get redirected to my frontend route (also in the new tab), the behaviour is different from the behaviour in chrome. After the oauth flow finished and the new tab shows my frontend route, but the sIRTFrontend cookie is again set to remove.

rp_st

01/22/2023, 6:51 PM

Hmm. Usually safari issues are due to use cross site cookies. But I think in your case, the api and website domain values are the same right?

leolurchig

01/22/2023, 6:56 PM

Yes

rp_st

01/22/2023, 6:56 PM

Hmm. So there shouldn’t be any issue as such. Can I see the request and response headers for the request that creates a session?

leolurchig

01/22/2023, 6:57 PM

yep

leolurchig

01/22/2023, 7:02 PM

Also added this snippet, which generates this output. Getting the access token payload works, until the accessToken needs to be refreshed. When /session/refresh is called by the frontend sdk it returns a 401 and the accessToken payload can no longer be read

leolurchig

01/22/2023, 7:03 PM

sIRTFrontend is then set to remove

rp_st

01/22/2023, 7:10 PM

So I see a weird thing. Why is the sameSite value none in cookies?

rp_st

01/22/2023, 7:10 PM

Have you explicitly set it to none on the backend?

leolurchig

01/22/2023, 7:15 PM

these are my configs

rp_st

01/22/2023, 7:25 PM

The value of apiDomain should be localhost:3000 as well

rp_st

01/22/2023, 7:25 PM

Make that change, and try again.

leolurchig

01/22/2023, 7:28 PM

Uh ok males sense

leolurchig

01/22/2023, 7:47 PM

Ok just checked and that was the problem. Now it works :))

leolurchig

01/22/2023, 7:49 PM

Thanks a lot for all that first class support! Can I do anything for you? Something like writing a review anywhere? Or do you have a buymeacoffe ^^

rp_st

01/22/2023, 7:50 PM

You could tweet about us and tag @supertokensio in it

leolurchig

01/22/2023, 7:51 PM

Alright, I‘ll do that 🙂

leolurchig

01/22/2023, 11:54 PM

FYI: Just checked again and I used the config that was generated by the tool on your page. Which has the apiDomain for the appInfo set to the remote apiDomain. Might be a bit confusing

rp_st

01/23/2023, 2:45 AM

That’s cause you set it to that value in the form above

leolurchig

01/23/2023, 3:51 AM

Ahh ok I didn't get that the apiUrl of the backend is automatically added... Thought that would be the place to put in the supertokens api domain 😅

6 Views

Previous Next

SuperTokens.com

SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).