Does Next Auth handle automatic JWT refresh?

[iWanheda]

Question 💬

Not saying my provider's token, my own generated JWT token with:

It doesn't seem to be handling it automatically, since I wait 30s and then get logged out

(I'm using Discord as auth provider)

How to reproduce ☕️

None

Contributing 🙌🏽

No, I am afraid I cannot help regarding this

[noxify]

No, but there is a tutorial which explains how to implement it: https://next-auth.js.org/tutorials/refresh-token-rotation

[lantaozi]

Yes, it does.

30s is too short, but no problem. Just set proper refetchInterval less than 30s, and it will renew the cookie token automatically.

The value for refetchInterval should always be lower than the value of the session maxAge session option.

Ref: https://next-auth.js.org/getting-started/client#refetch-interval

[agusterodin]

I don't believe this library supports out-of-the-box token refresh. I believe refetchInterval lets you set how often your client reaches out to Next Auth backend. It is still up to you to handle token refresh logic on the Next Auth backend.

I had to implement refresh tokens myself for Google identity platform and it has weird issues. It doesn't help that Google tokens in particular are so short lived and expire quickly (probably intentional design by Google).

In my opinion, authentication is not a solved problem (and is a damn nightmare) until refresh tokens fully seamlessly work. Would love to see that in a future version of this library 🙏

Zero disrespect intended. Thank you to the maintainers of this awesome library.

[ThangHuuVu]

We don't have out-of-the-box support yet, but we absolutely want to do this 🙌 Things are a bit hectic at the moment for the core team, so PR is welcome!

[iWanheda]

You've got a PR that is almost working from what I've seen, can you not spare a few mates from the team to actually implement it? I'm not hating just asking :)

[hichemfantar]

I def agree that JWT auth is not complete without a token refresh strategy. Would love to see some movement on this.
Love to the team working on this project 🚀

[byanes]

This would be amazing to have. Thank you for the amazing work!

[vwatel]

Hey guys,
Any update on this one? I'm also looking for refresh token strategy in order to have end-to-end integration using this great library.
Than you :)

[nreh]

I also followed https://next-auth.js.org/tutorials/refresh-token-rotation to implement token refreshing

However, for some reason the re-fetch interval doesn't seem to line up with my token's expiration time, (my guess is that the token is acquired from some cache or cookies so it might already be close to expiration). As a result there is a small window between token expiration and refetching where the token is invalid for making API calls.

In addition, I assumed that the JWT callback function would fire every time useSession is called, as indicated by the documentation:

https://next-auth.js.org/configuration/callbacks#jwt-callback

Requests to /api/auth/signin, /api/auth/session and calls to getSession(), unstable_getServerSession(), useSession() will invoke this function, but only if you are using a JWT session.

However, I found this issue #4227 which indicates that this is not the case:

There is no session refetching by default, useSession uses what's in the cache. You can poll the session if you need to trigger the JWT callback.
https://next-auth.js.org/getting-started/client#refetch-interval
Another option is using getSession which always visits the backend: https://next-auth.js.org/getting-started/client#getsession

I'm trying to find a way to modify the useSession hook so that if the token is expired, it automatically requests a new one but I'm not sure how to override it nor do I know how to manually trigger a repoll of the token.

At this point I'm thinking of making the refetchInterval to a short timespan and making the token lifespan longer, but that seems like a very wasteful workaround.

[stale]

It looks like this issue did not receive any activity for 60 days. It will be closed in 7 days if no further activity occurs. If you think your issue is still relevant, commenting will keep it open. Thanks!

[andrei-ivanov]

no activity doesn't mean it's not needed