#SSR Oauth in Nextjs not working properly

45 messages · Page 1 of 1 (latest)

spice palm
#

Hi,

export async function GET(request: NextRequest) {
  const userId = request.nextUrl.searchParams.get("userId");
  const secret = request.nextUrl.searchParams.get("secret");

  if (!userId || !secret) {
    return NextResponse.json({ error: "Invalid request" }, { status: 400 });
  }

  const { account } = await createAdminClient();
  const session = await account.createSession(userId, secret);

  cookies().set("my-custom-session", session.secret, {
    path: "/",
    httpOnly: true,
    sameSite: "strict",
    secure: true,
  });

  return NextResponse.redirect(`${request.nextUrl.origin}/`);
}

this code redirectes user to home page, but actually when redirected at the same time i am calling


export async function getLoggedInUser() {
  try {
    const { account } = await createSessionClient();
    return await account.get();
  } catch (error) {
    console.log(error);
    return null;
  }

this function and this function return null, after refresh its still returns null. But when i enter url to browser and login again it works

#

user is updated

#

i dont understand, i followed docs and its not working

# 
  cookies().set("my-custom-session", session.secret, {
    path: "/",
    httpOnly: true,
    sameSite: "lax",
    secure: true,
  });

would that be good option?

river yoke
#

<@&634618551491100692> please, any idea, we are stuck. It is working but we have no idea if it is the most secure implementation

spice palm
#

i meant in nextjs strict not working
when redirected and cookie was added
browser still is in old state
and is not consistent to new cookie
that was successfuly added
thats why i changed strict to lax and it was working
actually, i didnot have time and not searched about that attributes
i copied everything from docs, maybe docs need to update

#

in docs 'strict' was written, dunno if u tested this before u wrote that in docs

thorny smelt
#

Does it work if you refresh the page after logging in?

spice palm
#

nope

#

in 'strict' mode

#

refreshing not working

thorny smelt
#

Do you have the code for createSessionClient()?

spice palm
#

but if i enter url from address bar

# 
export async function createSessionClient() {
  const client = new Client()
    .setEndpoint(process.env.NEXT_PUBLIC_APPWRITE_ENDPOINT!)
    .setProject(process.env.NEXT_PUBLIC_APPWRITE_PROJECT!);

  const session = cookies().get("my-custom-session");
  if (!session || !session.value) {
    throw new Error("No session");
  }

  client.setSession(session.value);

  return {
    get account() {
      return new Account(client);
    },
  };
}```
thorny smelt
spice palm
#

yep

thorny smelt
#

Try this change after you set the cookie

const response = NextResponse.redirect(`${request.nextUrl.origin}/`);
response.cookies.set("my-custom-session", session.secret);
return response;
spice palm
#

i thought about that, i did not try

#

lets test it

#

should i also pass

#

expire date and other attributes?

thorny smelt
#

I don't think it's needed at this point, I've only tested it with just the value so best to see if that works before we start adding anything else to it

spice palm
#

it would work if it doesnt set attribute as 'strict'

#

thats why i asked

#

okay working

#

as i said

#

its working because sameSite is None

# 
  response.cookies.set("my-custom-session", session.secret, {
    sameSite: "strict",
  });
#

i have this and its not working again

thorny smelt
#

Hmm... this does seem like it could be a security issue though as this would make it a cross-site cookie

spice palm
#

Yep, dont know a lot about these stuff

#

Is there any solution for that

thorny smelt
#

Let me take a look and see if I can find a solution, this looks like it's more likely to be a Next issue

spice palm
#

i wrote about that on nextjs server as well

lucid forge
#

Are you using cloud? what is your SDK version?

river yoke
#

No, self-hosted

#

1.5.7

river yoke
lucid forge
#

Cloud isn't using a different ask however your project could have a old version, SSR had some problems a it was solved in one of the latest versions

spice palm
#

everything is latest

lucid forge
#

After the user is logged, can you see the cookie in the browser?

Can you look the value of const session = cookies().get("my-custom-session"); in createSessionClient

The problem seems like the SDK isn't getting the right session

spice palm
#

okay i will see later

elder widget
#

If the sameSite is "Lax" or not present it works. Else it does not.
cookie is not retrieved inside the createSessionClient in the initial redirect.

But after Oauth login, refresh works when the same site is set. Please help

image.png
elder widget