Does Nextauth rotate the session token for email auth?

[anguskeatinge]

I'm running into some bugs (I think) with the session not being persisted properly and I want to handle this myself.

const options = {
    ...
    providers: [
        EmailProvider({
            ...
        }),
    ],
    adapter: MongoDBAdapter({ db }),
    session: {
        jwt: false,
        maxAge: 30 * 24 * 60 * 60, // 30 days
        updateAge: 24 * 60 * 60, // 1 day
    },
   ...
}

[balazsorban44]

Will need a reproduction.

[anguskeatinge]

It would probably make sense to rotate the sessionToken and probably sign it as well (e.g. jwt.sign()).
☝️ I'm doing this now - it doesn't seem like much extra work for a bunch more security.

[balazsorban44]

Thanks. After checking https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#renew-the-session-id-after-any-privilege-level-change

I did not find a recommendation for token rotation on every session check.

I did understand that we could probably generate a harder to guess session token though

next-auth/src/core/lib/callback-handler.ts

Line 224 in 043b252

return randomUUID?.() ?? randomBytes(32).toString("hex")

any suggestions?

[anguskeatinge]

Thanks for the resource 👍
Let me scout about for some resources to back up my approach, I'll get back to you on that.

Fwiw I'm only rotating the sessionToken when it we update the expiry, i.e. daily.
And then I am setting the expiry of the old session (in the db) to 15 mins away so concurrent requests with old session tokens don't fail. (I recognise that I'll need a job to clean up old sessions to prevent bloat)

Hmm, well the randomUUID is kinda meaningless atm because the latest runtime for aws Lambdas is 14.x
This guy reckons we should use the uuid package.
https://gist.github.com/joepie91/7105003c3b26e65efcea63f3db82dfba
https://www.npmjs.com/package/uuid

[anguskeatinge]

Haha, after reading that joepie gist in more detail, it looks like randomBytes(32).toString("hex") is probably acceptable because we aren't modding or transforming the output.

[anguskeatinge]

So it turns out updating the session on the backend is fraught because dealing with concurrent requests is a hassle.

I guess the only way to deal with that is to make sure the SessionProvider is the only thing that calls /api/auth/session.
Then the only potential for concurrency is when you're opening up multiple tabs at the exact same time...

Haha, look, I'm just going to hack away at this and I'll let you know how I go when the dust has settled. 😄