How might you add request info in session information?

[reconbot]

Question 💬

I'd like to capture browser, last accessed and IP info when a database session is created or accessed. (Think gmail's "Last account activity" section)

In the future it would be nice to be able to invalidate sessions when I detect things change (say maybe the country changes?) or stop logins if you login from two countries at the same time. But what I need help with is;

1. I can update a database session's last accessed manually in the session callback (I don't have adapter access but I can make a global one), but I can't return null and log someone out.
2. I don't have access to any request information in createSession() in my adapter or session() in the nextauth callback. So I can't grab ip addresses or User-Agent headers.

Are there better approaches? Am I asking for new features?

How to reproduce ☕️

Nothing to reproduce, I'm either asking for api changes or ways to work around the issue.

Contributing 🙌🏽

Yes, I am willing to help answer this question in a PR

[ThangHuuVu]

1. I can update a database session's last accessed manually in the session callback (I don't have adapter access but I can make a global one), but I can't return null and log someone out.

As a workaround, I think you could try to use the global adapter to call deleteSession in the session callback?

2. I don't have access to any request information in createSession() in my adapter or session() in the nextauth callback. So I can't grab ip addresses or User-Agent headers.

You can't access request info in createSession(), but it's possible in the session callback. You can try Advanced Initialization.

import type { NextApiRequest, NextApiResponse } from "next"
import NextAuth from "next-auth"

export default async function auth(req: NextApiRequest, res: NextApiResponse) {

  // Get the req info like IP
  const ip = req.headers['x-forwarded-for']
  return await NextAuth(req, res, {
    ...
    callbacks: {
      session({ session, token }) {
        // Use the IP here
        session.ip = ip
        return session
      }
    }
  })
}

IMO it would be better to store request info during creating the session with createSession, as the session callback might be invoked multiple times afterward.
Instead of creating a new session and then discarding it via logging out, I think we could somehow check for the session validity first before creating to avoid computational overhead. 🤔 We can consider exposing a new API for granular control over this matter. Something like:

nextAuthOptions = {
  //... other options
  isSessionValid(lastSession, nextSession) {
    // decide if next session should be created
  }
}

[balazsorban44]

I've actually brought this up a while back #583, with a similar goal.

This might be an interesting feature request, but we would have to work out the details.

It is certainly possible in userland.

As Thang suggested, you can use the Advanced initialization to get hold of the request information for now. 👍