Next.js Discord

Discord Forum

Token rotation not remembering the token expiration date

Unanswered
Chilean jack mackerel posted this in #help-forum
Open in Discord
Chilean jack mackerelOP
So I have a problem with token rotation with the NextAuth.js and Spotify provider. The main idea works fine, checking if a profile is available and pushing it into a new object with access_token and access_token_expires. But now the real problem is when I try to change the access_token_expires. The function that refreshes access_token is working fine and returns the correct object, but this object is not being remembered by the JWT callback, and it returns first remembered access_token_expires causing to call refresh_token() function everytime. Any ideas about what I am doing wrong?

export const NextAuthOptions: AuthOptions  = {
    providers,
    secret: process.env.NEXTAUTH_SECRET,
    callbacks: {
        async session(_, token){
            return _.token as AuthSession
        },
        async jwt(prevToken: any) {
            console.log('> Checking JWT <')

            if(prevToken.account && prevToken.profile){
                return {
                    access_token: prevToken.account.access_token,
                    access_token_expires: new Date(addSeconds(new Date(), (3600 - 10))),
                    refresh_token: prevToken.account.refresh_token,
                    user: prevToken.user,
                }
            }
            if(new Date() < new Date(prevToken.token.access_token_expires)){
                return prevToken.token
            }

            const returned = await refreshToken(prevToken.token);
            return returned
        }
    }
}


refreshToken() function is the same as in https://github.com/nextauthjs/next-auth/discussions/1053#discussioncomment-265810

6 Replies

Devon Rex
it looks like you need to change the access token expiration time inside the refresh token function again in addition to jwt callback
@Devon Rex it looks like you need to change the access token expiration time inside the refresh token function again in addition to jwt callback
Chilean jack mackerelOP
Well, I'm changing it by passing new object as a return object in JWT callback, here is a function:
export async function refreshToken(token: any){
    console.log(" > Refreshing token...");
    const request = await fetch("https://accounts.spotify.com/api/token", {
        method: "POST",
        headers: {
            "Content-Type": "application/x-www-form-urlencoded",
            Authorization: `Basic ${Buffer.from(`${process.env.SPOTIFY_CLIENT_ID}:${process.env.SPOTIFY_CLIENT_SECRET}`).toString("base64")}`,
        },
        body: `grant_type=refresh_token&refresh_token=${token.refresh_token}`,
        cache: "no-cache"
    });
    
    const response = await request.json();
    console.log("> Received response: ", response)

    if(!request.ok)
        throw response
    
    const accessTokenExpires = addSeconds(
        new Date(),
        response.expires_in - 10
    )

    console.log(" > Updating expiration date: " + accessTokenExpires)
    return {
        ...token,
        access_token: response.access_token,
        access_token_expires: accessTokenExpires,
        refresh_token: token.refresh_token,
    }
}


it returns object correctly but it's not updating the jwt callback on the next call.
Devon Rex
recently i have been working with those kinds of cases and what i did was i looked into this article https://next-auth.js.org/v3/tutorials/refresh-token-rotation and try it and it works perfectly but in my case the api handles the access token expiration and it throws an error when the access token expires so i used that error to reflect it to my frontend to logout and to force it to login page.
Chilean jack mackerelOP
unfortunately, it's the same logic I have already implemented but it's still not updating the access_token_expires.
no errors are there either
Chilean jack mackerelOP
but now I'm wondering why I can push the new value into my object but I can't change it 🤔