How might you add request info in session information?

[reconbot]

Question 💬

I'd like to capture browser, last accessed and IP info when a database session is created or accessed. (Think gmail's "Last account activity" section)

In the future it would be nice to be able to invalidate sessions when I detect things change (say maybe the country changes?) or stop logins if you login from two countries at the same time. But what I need help with is;

1. I can update a database session's last accessed manually in the session callback (I don't have adapter access but I can make a global one), but I can't return null and log someone out.
2. I don't have access to any request information in createSession() in my adapter or session() in the nextauth callback. So I can't grab ip addresses or User-Agent headers.

Are there better approaches? Am I asking for new features?

How to reproduce ☕️

Nothing to reproduce, I'm either asking for api changes or ways to work around the issue.

Contributing 🙌🏽

Yes, I am willing to help answer this question in a PR

[ThangHuuVu]

1. I can update a database session's last accessed manually in the session callback (I don't have adapter access but I can make a global one), but I can't return null and log someone out.

As a workaround, I think you could try to use the global adapter to call deleteSession in the session callback?

2. I don't have access to any request information in createSession() in my adapter or session() in the nextauth callback. So I can't grab ip addresses or User-Agent headers.

You can't access request info in createSession(), but it's possible in the session callback. You can try Advanced Initialization.

import type { NextApiRequest, NextApiResponse } from "next"
import NextAuth from "next-auth"

export default async function auth(req: NextApiRequest, res: NextApiResponse) {

  // Get the req info like IP
  const ip = req.headers['x-forwarded-for']
  return await NextAuth(req, res, {
    ...
    callbacks: {
      session({ session, token }) {
        // Use the IP here
        session.ip = ip
        return session
      }
    }
  })
}

IMO it would be better to store request info during creating the session with createSession, as the session callback might be invoked multiple times afterward.
Instead of creating a new session and then discarding it via logging out, I think we could somehow check for the session validity first before creating to avoid computational overhead. 🤔 We can consider exposing a new API for granular control over this matter. Something like:

nextAuthOptions = {
  //... other options
  isSessionValid(lastSession, nextSession) {
    // decide if next session should be created
  }
}

[reconbot]

Actually I don't want the ip to be in the session, I want it to be in the session database model. The session callback is for the user facing session information, correct?

So I could update the database in this callback.

And could I return null to log someone out after deleting the session?

[ThangHuuVu]

Yes I believe return null works, I just tested it locally

[reconbot]

I was able to pass the request and response to the database connector. This let me read headers and use them in the database layer. On the flip side, I'd like to make database information about the session available to the session but I only get the user database object in the session({ user, session }) callback. The session object is generated from the user and not the actual session.

https://github.com/nextauthjs/next-auth/blob/main/packages/next-auth/src/core/routes/session.ts#L127-L139

Other than loading everything onto the user object is there a better way to get the database session information to the callback?

[reconbot]

The arguments for the session callback {user, token, session} is a little awkward but to keep the backwards compatibility we could add a databaseSession argument? It does not seem that we have access to the database session in any callbacks (it's only used to update the expires time).

If I was rewriting the callback I'd have the default callback build the { name, email, image } from { session, user } where session is the jwt or the database object and user is the optional database user`. That is if I understand the concepts correctly.

[ThangHuuVu]

Other than loading everything onto the user object is there a better way to get the database session information to the callback?

AFAIK this is the only way for now. Since session is only used for presentational purposes, we could enhance it instead of exposing the database session object; this could be the original design goal of the code 🤔

[balazsorban44]

I've actually brought this up a while back #583, with a similar goal.

This might be an interesting feature request, but we would have to work out the details.

It is certainly possible in userland.

As Thang suggested, you can use the Advanced initialization to get hold of the request information for now. 👍

[nandox5]

this does not work if you use the unstable get session on serversideprops.

tried it and it gives me an error since the authoptions on serversideprops do not match with the authoptions of advance initialization

[ethndotsh]

What's the best way to do this in v5?