Bug: `/api/auth/setup` is failing with 401 Unauthorized about kinde-auth-nextjs HOT 7 OPEN

This is current intended behaviour. Due to security measures the access token cookie is not readable by javascript so the browser knows nothing about the user. This /setup endpoint returns the data about the user based on cookie access token to the browser can setup the browser client.

The 401 happens when the user is not signed in as no token is present it doesn't have access to the route.

This is something we want to improve in the future.

from kinde-auth-nextjs.

Sadly, 401 errors cannot be omitted from the console. They are always outputted there is no way to prevent this.

from kinde-auth-nextjs.

TIL. I guess you'd have to return 200 { isLoggedIn: boolean } and reserve 401 for real unauthorised access attempts. Which is a slightly bigger job.

No worries then thanks for looking into this!

from kinde-auth-nextjs.

I just realised that this is 401ing only when there's no active user session, and once I login the request to /api/auth/setup succeed.

Sounds like a bug in the useEffect, which shouldn't fire if there's no active user session.

For reference, this is the problematic code

  const { user } = useKindeBrowserClient();

IIUC that's how I'm meant to check if a user is logged in or not, and hence there should be no call to /setup if it requires an active user session.

from kinde-auth-nextjs.

I see thank you!

@DanielRivers should we handle the request rejection and swallow it then to avoid spamming the console?

If it's intended behaviour, there's a low-hanging fix to wrap it in a try/catch, and swallow the 401 errors? If it's any other status code we can rethrow.

Either way I'll leave it with you and the team 🙂

from kinde-auth-nextjs.