How to properly implement JWT token rotation?

[mabaranowski]

Hello, I'm using the credential provider with custom backend, and AccessToken & RefreshToken.

For testing purposes:

• AccessToken expires after 10min
• RefreshToken expires after 20min

In [...nextAuth].js jwt callback i do check if I should refresh the token after 9min:

if (Date.now() < token.accessTokenExpiry - (9 * 60 * 1000)) {
  // Refresh token
}

In _app.js I've got refetchInterval set to 10min:

<SessionProvider session={pageProps.session} refetchInterval={600}>

The problem is:

1. refetchInterval checks are quite random, sometimes it checks every 5min, sometimes 15min (most often is 9min or 11min) - is it expected?
2. refetchInterval starts again after the page refresh, so If the interval is set to the accessToken length, and I refresh the page, it will start the count again, exceeding the accessToken validity.
3. I cannot manually refresh token, on http 401 from external api, because the refetchInterval has not elapsed yet.

To sum it up:

• If I log in at 12:00, the app will try to get a new token at 12:10.
• But If i log in at 12:00, and at 12:03 I will refresh the page, the app will try to get a new token at 12:13, meaning the time between 12:10 - 12:13 I've got an expired token.

What am I missing here?
The docs here: https://next-auth.js.org/tutorials/refresh-token-rotation do not really help with refetchInterval.
Thanks you all the help.

[mabaranowski]

Check #4076 If anyone stumbles across this problem in the future