Update session without signing out and signing in with Credentials provider

[sheptang]

Question 💬

I've created a modal with several form elements, which the users would update their profile information.

Instead of calling for email, username, birthday and profilePic from the database from every component and on every page change NextJS router.push("/whatever"), I'd like to persist this data on the session object itself. That's why, when user initially signs in and the signIn callback gets fired, I'm writing all this information on the session object.

And that's how I retrieve this data for the profile updating modal. But when I try to persist this data for the whole session, until the re-signin from the user. But I'm doing this currently as follows: session.userProfile = newUserProfile. But the problem is, this does not persist on other tabs and on every page refresh, I lose these changes.

I've tried also calling the signIn function again as shown below, after session overwrite, however, it does not get fired at all. I assume this is because there is already an existing user session.

async () => {
	await signIn("credentials", {
		...session.userProfile,
		redirect: false
	});
}

I've took a look at the docs, but I couldn't find any detailed information on how to achieve this.
Additionally, I'm aware that the JWT is involved in this, too. But I'd appreciate more details if I'd really have to create new access-tokens and expiry times, as I'm not sure if there's an easier way.

How to reproduce ☕️

Do the changes as suggested above and refresh the page, see the session object resets to its original form as passed from authorize callback.

Contributing 🙌🏽

I'm afraid I wouldn't be able to contribute unless there's a missing feature.

[sheptang]

I've found the solution myself.

I had to connect that async function I wrote to a listener for session changes and it executes automatically, as I observed, whenever I change the session object, now the signIn callback fires.

[jayliew]

Hi, I'm running into the same issue, and I'm trying to understand your solution. Is the solution basically trying to signIn() the user again, so that the session.user data gets updated? I'm trying to do that .. but without re-using the user's plaintext password

[sheptang]

@jayliew Hey, please refer to this discussion, where I explain how I handle my method of achieving NextAuth's delicious security features while having my custom back-end for sign-in and sign-up logic.

So, tldr: I do not check for credential matching for sign-in using [...nextauth].js. I'm just creating the JWT and the session through NextAuth. All check for passwords and such are handled by my custom implementation in different files. That's why, I'm using signIn() callback only with username and email parameters after handling the checks myself.

So, that's why my answer to this discussion works for me.

[sheptang]

Also, I've just realized that I forgot to mention in the answer, I had to change the [...nextauth].js file to following for this session overwrite to work properly:

export default NextAuth({
	providers: [
		Providers.Credentials({
			authorize: async (credentials) => {
				const user = {
					username: credentials.username,
					email: credentials.email
				}
				if(credentials.birthday){
					user.birthday = credentials.birthday;
				}
				if(credentials.profilePic){
					user.profilePic = credentials.profilePic;
				}
				return user;
			}
		})
	],
	callbacks: {
		async signIn(user){
			if(user){
				return user;
			}
		},
		async jwt(token, user){
			user && (token = {
				...token,
				userProfile: user
			});
			return token;
		},
		async session(session, user){
			if(user.userProfile){
				session.userProfile = user.userProfile;
			}
			return session;
		}
	}
});

Here, I'm persisting partially sensitive user data inside the JWT itself. But it is already hashed with the secret key, which is accessible only on the server side via the environment variables. Therefore, for my standards, it's safe enough as the user data doesn't consist of nuclear launch codes.