Refresh Token (JWT_SESSION_ERROR)

[OmkarMehta]

Question 💬

I am using NextAuth for signing in Nvidia users into my portal. When access token is expired, I have used the "Refresh Token Rotation" docs to refresh the token. While the response is 200, NextAuth throws JWT_SESSION_ERROR.

Here's my code:

import NextAuth from "next-auth"
import axios from "axios"



export default NextAuth({
    providers: [{
        id: "nvidia",
        name: "Nvidia",
        type: "oauth",
        version: "2.0",
        wellKnown: "",
        authorization: {
            params: {
                scope: "openid email profile",
                response_type: "code",
            }
        },
        token: {
            params: {
                grant_type: "authorization_code",
            }
        },
        idToken: true,
        checks: "state",
        httpOptions: {
            timeout: 30000,
        },
        profile: (profile, id_token) => {
            return {
                id: profile.sub,
                name: profile.name,
                email: profile.email,
                // id_token: id_token.id_token,
            }
        },
        client: {
            authorization_signed_response_alg: "ES256",
            id_token_signed_response_alg: "ES256",
        },
        clientId: process.env.NVIDIA_CLIENT_ID,
        clientSecret: process.env.NVIDIA_CLIENT_SECRET,
    }, ],
    debug: true,
    callbacks: {
        async jwt({ token, user, account, profile, isNewUser }) {
           

            if (account) {
                token.id_token = account.id_token;
                token.access_token = account.access_token;
                token.access_token_expiry = Date.now() + 36000 * 1000;
                token.refresh_token = account.refresh_token;
                // console.log("refreshAccessToken: ", refreshAccessToken(token));
            }

           
            if (Date.now() < token.access_token_expiry) {
                // console.log("we have a token: ", token);
                return token;
            }

            
            return refreshAccessToken(token);
        },

    },
    

})

async function refreshAccessToken(tokenObject) {
    console.log("tokenObject before: ", tokenObject);
   
    const params = new URLSearchParams({
        grant_type: 'refresh_token',
        refresh_token: tokenObject.refresh_token,
    });
    
    let api_url = "";
    console.log("api_url: ", api_url);

    const response = await axios.post(api_url, params.toString(), {
        headers: { 'content-type': 'application/x-www-form-urlencoded' },
        auth: { username: process.env.NVIDIA_CLIENT_ID, password: process.env.NVIDIA_CLIENT_SECRET }
    });
    console.log("response axios: ", response);
    const data = await response.data;
    console.log("tokenResponse", data);
   
    console.log("data.id_token: ", data.id_token);

    return {
        ...tokenObject,
        id_token: data.id_token,
        access_token: data.access_token,
        access_token_expiry: Date.now() + 36000 * 1000,
        refresh_token: data.refresh_token,
    };

}

My organization wants to have "ES256" signing algorithm.

Here is the response from AXIOS.

response axios:  {
  status: 200,
  statusText: '',
  headers: {
    date: 'Fri, 22 Jul 2022 18:05:11 GMT',
    'content-type': 'application/json;charset=UTF-8',
    'transfer-encoding': 'chunked',
    connection: 'close',
    vary: 'Origin, Access-Control-Request-Method, Access-Control-Request-Headers',
    'cache-control': 'no-store',
    pragma: 'no-cache'
  },

After this, I get the following error.

[next-auth][error][JWT_SESSION_ERROR]
https://next-auth.js.org/errors#jwt_session_error Request failed with status code 400 {
  message: 'Request failed with status code 400',
  stack: undefined,
  name: 'AxiosError'
}

How to reproduce ☕️

import NextAuth from "next-auth"
import axios from "axios"



export default NextAuth({
    providers: [{
        id: "nvidia",
        name: "Nvidia",
        type: "oauth",
        version: "2.0",
        wellKnown: "",
        authorization: {
            params: {
                scope: "openid email profile",
                response_type: "code",
            }
        },
        token: {
            params: {
                grant_type: "authorization_code",
            }
        },
        idToken: true,
        checks: "state",
        httpOptions: {
            timeout: 30000,
        },
        profile: (profile, id_token) => {
            return {
                id: profile.sub,
                name: profile.name,
                email: profile.email,
                // id_token: id_token.id_token,
            }
        },
        client: {
            authorization_signed_response_alg: "ES256",
            id_token_signed_response_alg: "ES256",
        },
        clientId: process.env.NVIDIA_CLIENT_ID,
        clientSecret: process.env.NVIDIA_CLIENT_SECRET,
    }, ],
    debug: true,
    callbacks: {
        async jwt({ token, user, account, profile, isNewUser }) {
           

            if (account) {
                token.id_token = account.id_token;
                token.access_token = account.access_token;
                token.access_token_expiry = Date.now() + 36000 * 1000;
                token.refresh_token = account.refresh_token;
                // console.log("refreshAccessToken: ", refreshAccessToken(token));
            }

           
            if (Date.now() < token.access_token_expiry) {
                // console.log("we have a token: ", token);
                return token;
            }

            
            return refreshAccessToken(token);
        },

    },
    

})

async function refreshAccessToken(tokenObject) {
    console.log("tokenObject before: ", tokenObject);
   
    const params = new URLSearchParams({
        grant_type: 'refresh_token',
        refresh_token: tokenObject.refresh_token,
    });
    
    let api_url = "";
    console.log("api_url: ", api_url);

    const response = await axios.post(api_url, params.toString(), {
        headers: { 'content-type': 'application/x-www-form-urlencoded' },
        auth: { username: process.env.NVIDIA_CLIENT_ID, password: process.env.NVIDIA_CLIENT_SECRET }
    });
    console.log("response axios: ", response);
    const data = await response.data;
    console.log("tokenResponse", data);
   
    console.log("data.id_token: ", data.id_token);

    return {
        ...tokenObject,
        id_token: data.id_token,
        access_token: data.access_token,
        access_token_expiry: Date.now() + 36000 * 1000,
        refresh_token: data.refresh_token,
    };

}

Contributing 🙌🏽

Yes, I am willing to help answer this question in a PR

[balazsorban44]

This might happen for other reasons as well:

next-auth/packages/next-auth/src/core/routes/session.ts

Lines 44 to 84 in b107ca4

	const decodedToken = await jwt.decode({
	...jwt,
	token: sessionToken,
	})
	const newExpires = fromDate(sessionMaxAge)
	// By default, only exposes a limited subset of information to the client
	// as needed for presentation purposes (e.g. "you are logged in as...").
	const session = {
	user: {
	name: decodedToken?.name,
	email: decodedToken?.email,
	image: decodedToken?.picture,
	},
	expires: newExpires.toISOString(),
	}
	// @ts-expect-error
	const token = await callbacks.jwt({ token: decodedToken })
	// @ts-expect-error
	const newSession = await callbacks.session({ session, token })
	// Return session payload as response
	response.body = newSession
	// Refresh JWT expiry by re-signing it, with an updated expiry date
	const newToken = await jwt.encode({
	...jwt,
	token,
	maxAge: options.session.maxAge,
	})
	// Set cookie, to also update expiry date on cookie
	const sessionCookies = sessionStore.chunk(newToken, {
	expires: newExpires,
	})
	response.cookies?.push(...sessionCookies)
	await events.session?.({ session: newSession, token })

You might be using a custom jwt decode/encode method? Or maybe forgot to define NEXTAUTH_SECRET?

[OmkarMehta]

Hi @balazsorban44, I am not using custom encode and decode, as you can see from the above code.
I have set up NEXTAUTH_SECRET in .env file. The signing algorithm needs to ES256.

[OmkarMehta]

Hey @balazsorban44, I was going through various discussion articles and came across #3940 . I have faced the same issue with single tab, when there are two calls to update the access token. You have mentioned in that discussion that you have found a temporary solution in your organization. Is it okay if you could share your github repo for the same?