Session cookies not changing when session is updated about auth-astro HOT 4 OPEN

I found this too, using astro & svelte, with the node server. After some time debugging, I made a small change to the getSession helper, you may find this useful. Essentially the jwt's cookie is never set.

`
import { Auth } from '@auth/core'
import type { Session } from '@auth/core/types'
import authConfig from 'auth:config'

/**

• Fetches the current session.

• @param req The request object.

• @returns The current session, or null if there is no session.
  */
  export async function getSession(astro:any, options = authConfig): Promise<Session | null> {

  const req = astro.request;

  //console.log('getSession start')

  // @ts-ignore
  options.secret ??= import.meta.env.AUTH_SECRET
  options.trustHost ??= true

  const url = new URL(${options.prefix}/session, req.url)
  const response = await Auth(new Request(url, { headers: req.headers }), options)
  const { status = 200 } = response

  //console.log('getSession response', response);
  //console.log('getSetCookie', response.headers.getSetCookie())
  const data = await response.json()

  // return the cookie
  const setCookie = response.headers.getSetCookie();
  if (setCookie) {
  astro.response.headers.set('Set-Cookie', setCookie)
  }

  if (!data || !Object.keys(data).length) return null
  if (status === 200) return data;
  throw new Error(data.message)
  }
  `

Note that usage changes from 'const session = await getSession(Astro.request);' to 'const session = await getSession(Astro);'.

Works for me :-)

from auth-astro.

Hi, I have the same problem, I am using astro with node how server and keycloak how provider, I can login and logout without problem, and refresh token is ok and I received the token correct, but the values in the token are always the same I cant update the first token received
'`import KeyCloak from '@auth/core/providers/keycloak';

import { defineConfig } from 'auth-astro';

async function refreshAccessToken(token){

try {
const PATH = '/protocol/openid-connect/token'
const url = import.meta.env.AUTH_KEYCLOAK_ISSUER + PATH
const options = {
method: "POST",
headers: {
"Content-Type": "application/x-www-form-urlencoded"
},
body: new URLSearchParams({
client_id: import.meta.env.AUTH_KEYCLOAK_ID,
client_secret: import.meta.env.AUTH_KEYCLOAK_SECRET,
grant_type: "refresh_token",
refresh_token: token.refreshToken
})
}
const response = await fetch( url , options )

const refreshedTokens = await response.json()

if (!response.ok) throw refreshedTokens


return {
  ...token,
  accessToken: refreshedTokens.access_token,
  idToken: refreshedTokens.id_token,
  accessTokenExpires: Date.now() + refreshedTokens.expires_in * 1000,
  refreshToken: refreshedTokens.refresh_token ?? token.refresh_token,
}

} catch (error) {
console.log(error)

return {
  ...token,
  error: "RefreshAccessTokenError",
}

}
}

export default defineConfig({
providers: [
KeyCloak({
clientId: import.meta.env.AUTH_KEYCLOAK_ID,
clientSecret: import.meta.env.AUTH_KEYCLOAK_SECRET,
issuer: import.meta.env.AUTH_KEYCLOAK_ISSUER,
redirectProxyUrl: import.meta.env.REDIREC_URL,
})
],
callbacks: {
async jwt({token, account, user}) {
if (account && user ) {
return {
accessToken: account.access_token,
idToken: account.id_token,
accessTokenExpires: Date.now() + account.expires_in * 1000,
refreshToken: account.refresh_token,
user,
}
}

  if (Date.now() < token.accessTokenExpires) {
    return token
  } 
  return await refreshAccessToken(token)
 
},
async session({session, token}) {
  if (token) {
    session.user = token.user
    session.accessToken = token.accessToken
    session.accessTokenExpires = token.accessTokenExpires
    session.idToken = token.idToken
    session.error = token.error
  }
  
  return session
  
}

},
events: {
async signOut({ token }) {
const url = new URL(import.meta.env.AUTH_KEYCLOAK_LOGOUT_URL)
url.searchParams.set('client_id',import.meta.env.AUTH_KEYCLOAK_ID)
url.searchParams.set('id_token_hint', token.idToken)
url.searchParams.set('post_logout_redirect_url', encodeURIComponent(import.meta.env.REDIRECT_URL))

  await fetch(url);
},

},
});
`

from auth-astro.

Hi, sorry for only answering now.
As I´m not using Auth.Js with Credentials and custom JWT issueing it´s harder for me to test and debug this. @amb1ent seems to have found a solution, tho I can´t see anything similar in other frameworks packages.

In the Auth.js Guides on Refresh Token Rotation they also make use of the session callback function to write information from token to session. Could you please try this as well and let me know if this fixes things?

from auth-astro.

I am using an implementation similar as the code in the example, the problem is that the library dont call when the token is refresh 'http://localhost:4321/api/auth/session', I have modified my code for when the token need refresh I send in the error field a message "renew" and then make fetch to the url and the token in storage is update, the problem is the boilerplate because this code can't be install in the middleware, i think that the problem can be the output mode, now I have the mode in server with node

Best regards

Thanks for all

Sorry for my english

from auth-astro.