Next.js Discord

Discord Forum

Are refresh tokens not automatically handled?

Unanswered
Gharial posted this in #help-forum
Open in Discord
GharialOP
As the title states, are refresh tokens not automatically handled? I'm using the cognito provider and I've given it the client id, secret and issuer. My access token and id tokens expire after 5 minutes. Refresh is good for 30 days. But for some reason my tokens just expire and then that's it. Unauthorized in the app. However the useSession seems to think I'm still authenticated (which is odd. Unless it is refreshing my tokens but my hooks aren't updating with the latest token?)

I'm not sure if I'm actually having a bug or issue or if I just fundamentally misunderstand what's supposed to be managed here and what I'm supposed to implement myself. I've look around in the docs but can't seem to find anything on refresh tokens except something from v3. But that article doesn't seem to exist on v4 so I don't know if this library is supposed to now support automatic refreshing of tokens or what.

Thanks for your help

10 Replies

Polar bear
I think it has to do with server components not refreshing them automatically
unlike route handlers and others
so u gotta use a middleware
GharialOP
is there anywhere I can put logging that would let me know it is, in fact, refreshing?
and I'm testing in the [...nextauth] file and I'm logging out the session callback with the session and the access and id tokens remain consistent
tafutada777
afaik, Auth.js has nothing to do with OAuth provider tokens such as Google token and refresh token. from Auth.js, provider tokens are one of properties in JWT object.
thus, you need to refresh it manually, or using Google API SDK.
GharialOP
that's what I was begining to realize. idk, I thought refreshing with oauth was pretty standard so I figured the lib would handle it. Or at least attempt to.