How are you guys refreshing the user's access_token for infinite sessions? (Supabase auth)

  • benjamin.h-1353045504153620584

    Ben H

    1 month ago

    I'm not using the Supabase SDK on the frontend, so it seems like I need to call supabase.auth.refreshSession() from an edge function? Is this how you guys are doing it? I.e. every time the user goes to the dashboard, call this endpoint to refresh their auth? Or could store the expiry date in local storage to avoid calling the endpoint as often.
  • Tod-1353045505982201989

    Tod

    1 month ago

    Great energy @Ben H! Your continuous contribution to the toddle Community just made you advance to Community Level 6!
  • benjamin.h-1354281835798073454

    Ben H

    1 month ago

    Anyone have thoughts on this?
  • paspom-1354400955613057044

    Pascal

    1 month ago

    thats a good question
    I'm looking for a good solution too
    you could look up on page load, wheter the token is like 30 minutes or less away from expiration (assuming a user will be no longer than 30 minutes on one page, so that it is always "right on time")
    and if true, given that on page load, fire the refresh
    👍1
  • paspom-1354401306852462622

    Pascal

    1 month ago

    only problem would be the access token, that is exchanged by that function, which could cause jwt problems when replacing a cookie suddenly without page reload
    👍1
  • benjamin.h-1356326989216092301

    Ben H

    28 days ago

    I'm storing the refresh_token as an http cookie, but I'm having trouble passing it to my edge function. Is there anything special I need to do in my API request to pass the cookie? In the network tab under "Request Headers" I can see the refresh_token is there along with the access_token, but the cookie shows up as null in my edge function log:

    console.log('Raw Cookie Header Received:', req.headers.get('cookie'));
    1356326988595597526-image.png
    1356326989082001500-image.png
  • lucasg-1356331702590505082

    Lucas G

    27 days ago

    The auth header appears to be passing in the access_token, not the refresh one
  • Are you trying to pass both? If so they might need their own headers or to pass it in the body if that’s where the edge function is expecting it
  • lucasg-1356332285028204697

    Lucas G

    27 days ago

    You can’t pass multiple cookies in an auth header
  • benjamin.h-1356347618598457456

    Ben H

    27 days ago

    Thx Lucas. I was trying to pass both but I realized I don't actually need the access token. Putting the refresh token in the header seems to be working!