Pricing Blog

Access_token Expiration handler

  • the_guy01-1221096112744824852

    the_guy

    1 year ago

    I am currently in the process to handle the expiration of the access_token provided by supabase.

    In an application where the HTTPonly flag is not set, you can just read the access_tokens expiration time and redirect the user to the login.
    Alternatively, I could send an API request to a specific endpoint before the token expires to verify the token is valid and return a new access_token to have a seemles experience.

    How can something like this be done with supabase + toddle?
    Since the HTTPonly flag is checked, I cant read the expiration time of the token using a custom function.
    So I thought I just store the expiration time in local storage every time the access_token is set and check it periodically - then renew the access_token every time the token is about to expire.

    To do this, I found the sb_refresh_token what should be exactly for this purpose - however I am unable to read that as well due to the HTTPonly flag and found no toddle native way to use that in the payload.

    What can I do to not have my app just break when the token expires?
    The only alternative I see is:
    - store expiration time in local storage
    - once expiration time is about to be exceeded, "logout" the user automatically
  • basfenix-1223763003367751700

    Bas Fenix

    1 year ago

    Im also strugglin setting this up now. did you make it work @the_guy ? how to detect user inactivity in toddle so that the token can be refreshed?
  • the_guy01-1223930685602140252

    the_guy

    1 year ago

    I decided against a infinite loop that constantly checks a timestamp.
    In theory, it does not matter if you store the timestamp by yourself or if you somehow were able to read the JTW from Supabase as example.

    Main reason for me deciding against it is because it constantly creates load for a very small window where it actually serves its benefit.

    The solution I go for is I added a check function that looks at the error of an API response and redirects to login if the page you are currently on is considered "login only" content.

    This function sits in my ENV wrapper component that I am currently putting into a package for better maintenance as I already have to maintain that in multiple projects

    If you have a specific desired functionaly that you are looking for please let me know, I might be able to add it for the first release of the package.
  • basfenix-1223958239146938488

    Bas Fenix

    1 year ago

    Damn your not the_guy you're The Guy! A package like that would be very helpful for the toddle community. I use hosted auth pages from my backend provider. On succesfull login they call my apps "call back" url and pass the auth token and a refresh token. Ideally i would like users to stay logged into my app just as toddle has for example. There must be some auto refresh of the token going on.
  • Tod-1223958240648499290

    Tod

    1 year ago

    Great energy @Bas Fenix! Your continuous contribution to the toddle Community just made you advance to Community Level 3!
  • basfenix-1223958806871150612

    Bas Fenix

    1 year ago

    A package that manages this process together with a loader (to hide the flash of logged in only content) would be 🔥
  • basfenix-1223963533776130068

    Bas Fenix

    1 year ago

    Let me know if i can help in any shape or form
  • the_guy01-1223964102351786044

    the_guy

    1 year ago

    Do you have a video that shows the problem of the flashing content?
    Flashing content can come from different problems

    There are also multiple ways how to solve this, either on page or component level - I already have something in mind but I would like to know more about the problem you are facing
  • basfenix-1223972434558980167

    Bas Fenix

    1 year ago

    Its a general issue all new toddle builders face. There is an onload api check to auth/me endpoint which on error redirects to another url. Normally you see a flash of the actual content being displayed before the redirect kicks in. Guess it can be solved by putting a loader component on each page that shows only the loader and hides the page content unless auth/me is successful
  • basfenix-1223973575346622495

    Bas Fenix

    1 year ago

    Basic stuff like this would be great to have available in packages to kickstart any build.
  • the_guy01-1224003016722481324

    the_guy

    1 year ago

    Let me know if this already sufficient:

    https://www.loom.com/share/142a6de0812442c783f0457eb7dd30be

    I am currently thinking about not only looking at the auth/me but also looking at API Requests inside the wrapper so the loading screen only is removed when every API that we want to wait for has finished loading
  • basfenix-1224046402032635904

    Bas Fenix

    1 year ago

    When i load your dashboard url i can still see it before it redirects to the login page..also when i go back then it actually loads the page
  • the_guy01-1224051657889939486

    the_guy

    1 year ago

    The page from the video itself is in progress and might change from what you see in the video, the video should be used as reference.

    I made the loading screen optional ( as shown in the video ), its currently turned off - thats why you don't see it
    I have enabled it again so now you should be able to replicate the video.

    What do you mean by when you go back it actually loads the page?
    Can you describe this further?
  • basfenix-1224057974042001448

    Bas Fenix

    1 year ago

    Yes.. used the back button then i Stayed on dashboard page without getting kicked out 😅
  • basfenix-1224059696936255781

    Bas Fenix

    1 year ago

    Now its perfect. The loading and then redirect
  • basfenix-1224059985546186913

    Bas Fenix

    1 year ago

    Just seeing all your vars as null before they load, (just 1s) is that because you load content/labels externally via api?
  • basfenix-1224060297514451065

    Bas Fenix

    1 year ago

    1224060297321644032-Screenshot_2024-03-31-20-18-09-58_40deb401b9ffe8e1df2f1cc5ba480b12.jpg
  • the_guy01-1224065119701700639

    the_guy

    1 year ago

    Thats because this page still uses a custom function for i18n what is not available server side - this will be fixed by using a component function instead of the custom function
    👍1
  • basfenix-1224095351502278676

    Bas Fenix

    1 year ago

    Anyways if you choose to publish your login check and loader as a package that would be very helpful!
  • the_guy01-1224096817436954624

    the_guy

    1 year ago

    I am currently in the process of making it a package, I cant say when I am able to publish it yet - but it should be within days rather then weeks
  • basfenix-1225425393734127656

    Bas Fenix

    1 year ago

    great to hear shoot me a DM if you need help / early feedback!
  • the_guy01-1225426084988977234

    the_guy

    1 year ago

    I just finished my Table package so I will work on the ENV package now.

    Im just thinking about what to add to the Description page, its hard to show a hosted demo since its a wrapper and functionality is shown during development rather than in the final product.