Hello guys I have an issue with the logout on safari and on

Question

Hello guys I have an issue with the logout on safari and on mobile The server send a 200 but without the set cookie header so the user is still login after the logout Is is a known issue Is there a workaround

rp · Answer

hey < ronflai> can i see the set cookie response header when you call the sign in API A screenshot will do Also whats the value of your apiDomain and websiteDomain

ronflai · Answer

the set token response is too long to be display in our monitoring tool but there is main part

rp · Answer

whats the value of sameSite for the cookies

ronflai · Answer

SameSite=none

rp · Answer

right So safari doesn t respect that

rp · Answer

switch to using header based auth instead of cookie based

rp · Answer

search in our docs for token transfer method

rp · Answer

and then things should work

ronflai · Answer

can you indicate me the correct doc to follow for safari

rp · Answer

there is no docs specific to safari

ronflai · Answer

but in safari and on desktop it s work

rp · Answer

you should just change to using header based auth

rp · Answer

safari desktop should not work with sameSite none eithert

rp · Answer

unless you have changed the browser s setting

ronflai · Answer

what change should we make for this to work

rp · Answer

search for token transfer method in our docs please

rp · Answer

or you can tell me which recipe you use and i can send a link

ronflai · Answer

ok I found the doc but to understand it will send the token using header and not cookie right

rp · Answer

yes

rp · Answer

You don t need to do anythign really

rp · Answer

just set the config as per the docs

rp · Answer

and try again it should work

ronflai · Answer

but it s not really safe to send the token using header

rp · Answer

it s less secure yea

rp · Answer

the only other way to solve this is to use websiteDomain and apiDomain that share a same base domain

rp · Answer

so that the cookie sameSite resolves to `lax` and then it will work on safari as well

ronflai · Answer

ok thanks for the info

ronflai · Answer

And why the signin work then because now the signin is working fine is juste the logout

rp · Answer

cause sign in sends the cookies it s the browser which is ignoring it

rp · Answer

and logout requires cookies to work So since the browser did not save them it won t work

ronflai · Answer

but we have the token in browser because otherwise the Session doesSessionExist in the front end should return false

rp · Answer

not really there are other tokens on the frontend which are saved using which doesSessionExist works The ones that the browser ignores are httpOnly cookies

ronflai · Answer

when I try to use the transferMethod header in js app ts complaining that `tokenTransferMethod does not exist in type UserInput `

ronflai · Answer

what i did is just ```recipeList Session init tokenTransferMethod header Passwordless init preAPIHook context => addLocaleToCreateCodeRequest context activeLocale ```

rp · Answer

right Which version of the frontend sdk are you using

rp · Answer

and which frontend SDK

ronflai · Answer

supertokens web js ^0 3 0

rp · Answer

right So this feature is only available in version >= 0 5 0

rp · Answer

so update to that Be sure to check the changelog https github com supertokens supertokens web js blob master CHANGELOG md

rp · Answer

you would also need to update the backend sdk as mentioned in the above changlog

rp · Answer

so be sure to checkout the changelog of the backend sdk as well

ronflai · Answer

Ok thanks I ll try

ronflai · Answer

I have a new error saying st auth mode is not allowed in Access Control Expose Headers is it normal do I have to manually change the Access Control Expose Headers

rp · Answer

No Just update the backend SDK as well

ronflai · Answer

Yeah that what I did but still I have this issue

rp · Answer

Can I see the error on the browser console

rp · Answer

And what are the response headers for the OPTIONS api call And for the subsequent POST API call if that happens

ronflai · Answer

response header from api option call

ronflai · Answer

```access control allow credentials true access control allow headers Content Type X Amz Date Authorization X Api Key X Amz Security Token anti csrf rid fdi version access control allow methods OPTIONS DELETE GET HEAD PATCH POST PUT access control allow origin http localhost 3001 content length 1 content type application json date Thu 09 Mar 2023 15 19 35 GMT via 1 1 8cea2743cbaa04c70ebc2ec4f5892fa6 cloudfront net CloudFront x amz apigw id BhPZNFNFliAFYPA= x amz cf id WEmof5X7ZtZWyyf6IHPrriP5E lhMZ7rlrXyohwZ jegi43mPcRmyQ== x amz cf pop CDG52 P4 x amzn requestid 91db72e8 86d0 4f7c 9aa4 439b931ea796 x cache Miss from cloudfront```

rp · Answer

Right so you need to add st auth mode header to AWS CORS setting too Similar to how you added rid

ronflai · Answer

Oh yes you right I forgot about that

ronflai · Answer

I see that now we have st xxx cookies for access token and refresh token but the access token has a validity of several days instead of 1 hour as before

ronflai · Answer

so there is no refresh mechanism

rp · Answer

there is

rp · Answer

the access token cookie saved in storage is saved for a long time but the token s expiry itself is just 1 hour

rp · Answer

so even if the token is sent to the backend and it s been more than an hour the backend will reject it and trigger a refresh flow

ronflai · Answer

ok so the expiration is in your system right

rp · Answer

Yes

ronflai · Answer

Ok thank for the clarifications I also noticed that the `attemptRefreshingSession ` is returning a 401 now instead of returning false if the st access token is not there

rp · Answer

right yea Cause the st access token needs to be there for it to work this is an implementation detail But even if the access token has expired st access token will still be there resulting in `attemptRefreshingSession` to continue working

rp · Answer

the only time it will break is if you manually clear the st access token Which is what i assume you did right now

ronflai · Answer

yes indeed I m testing flow

ronflai · Answer

again thanks for the clarifications

ronflai · Answer

and in which case the `attemptRefreshingSession` could return false

rp · Answer

when the user is completely logged out

ronflai · Answer

alright gotcha Thanks

rp · Answer

i e no access token no refresh token and also `st last access token update` is present in the cookie storage