PricingBlog

Session Refresh

  • _.__._.__.__._-1412423187802755103

    Ethan

    4 months ago

    Hi all,

    How are you guys handling refresh tokens?

    Currently my app-provider runs a check on load to see if our access token is valid, if it isn't, it tries to use the refresh token, if that doesn't work, it takes the user to the login page.

    This works for short sessions but I expect my app will be open for longer, possibly a whole day at a time.

    I figure the best thing to do would be to either trigger the refresh every 45 mins or so, or have it trigger whenever an API fails to authenticate, although this would get messy, as it would have to be made for each API call, and then have the API call rerun.

    What are you guys doing, what would you suggest?
    1
  • app-provider is a component used at the root of all pages (except login ones)
  • martinf4630-1412727142847877230

    MartinF

    4 months ago

    I use supabase-js and pass access and refresh tokens in to it. Then listen for auth events like signed in and token refreshed, then set those values as cookies. This works well for long sessions and across multiple tabs. The way it is set up in the supa-protected-page-context component of the Supabase Connect package is also great and no supabase-js.

    Similar to you i call on page load to check tokens. I'm using the new getClaims() method which is proving to be faster than getUser() but i'm doing this in an edge function so that probably reduces any speed savings.
  • _.__._.__.__._-1412738500037709826

    Ethan

    4 months ago

    Thanks, I'm gonna do what supabase-connect does
    👍1