#Issue with NextAuth.js Token Refresh and Caching

2 messages · Page 1 of 1 (latest)

olive masonBOT
#
Post created!

🔎 This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

      🕵️ Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Profile" role in <id:customize>

      ✅ You can mark a message as the answer for your post with `Right click -> Apps -> Mark Solution`
      (if you don't see the option, try refreshing Discord with Ctrl + R)
little marsh
#

hi, I am facing an issue with NextAuth.js where token refresh and caching are causing unexpected behavior in my authentication flow. When I request a session from the server, the NextAuth.js callback function seems to be triggered twice. This issue becomes problematic when I need to change the refresh token because, during token refresh, it makes two parallel requests to the server. The first request is made with the current refresh token, and upon receiving the new refresh token, the current one is deleted on the server. However, since the second request is sent before the data update, it uses the old refresh token, which has already been deleted, resulting in a 403 error. Consequently, the user is redirected to the login page every 5 minutes instead of getting a new refresh-access token.
first request:

{
refreshToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY0OTJkMzQzOTY2YzhkMDk5Y2E0ZGNmYyIsImlhdCI6MTY5MDEzNDE3MiwiZXhwIjoxNjkwMjIwNTcyfQ.JsIlujWlpjPEFg9umbsR1dxkEUAUsA-UCR9oGyYaJAA'
}
{
newRefreshToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY0OTJkMzQzOTY2YzhkMDk5Y2E0ZGNmYyIsImlhdCI6MTY5MDEzNDE3MywiZXhwIjoxNjkwMjIwNTczfQ.8nbya7vRcIpoNJgKyNF28raHrPDl6hFVxKFwc_Q3Y3o'
}

second request: // it send the old refresh token so then it cause an error

{
refreshToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY0OTJkMzQzOTY2YzhkMDk5Y2E0ZGNmYyIsImlhdCI6MTY5MDEzNDE3MiwiZXhwIjoxNjkwMjIwNTcyfQ.JsIlujWlpjPEFg9umbsR1dxkEUAUsA-UCR9oGyYaJAA'
}
[next-auth][error][JWT_SESSION_ERROR]