What to use as salt when calling getToken() from @auth/core/jwt?

[jo-te]

In the latest version of authjs changes were made regarding the JWToken extraction.
The getToken function now requires a salt but I couldn't find any documentation regarding that.
Looking at the source code it seems that the salt gets a default value so maybe it normally can be ignored and omitted by the user of the library and it should me marked as optional in the GetTokenParams interface.
Nevertheless using the function in a SvelteKit context by calling getToken({req: request}) doesn't work anymore for me, even though the request object should contain all relevant data and cookies can be parsed correctly from it.
Is there anything I overlook?

[LucasForster]

Hi there!
Stumbled over the same thing using @auth/core 0.18.3:
Both decode and and getToken require a salt parameter, but Auth() does not take one.

After looking into the code like you did, I successfully got it running with "authjs.session-token" as the salt (running locally, that is - in production it probably needs to be prefixed with "__Secure-", haven't tried that yet).

Ideally, one would pass a salt to Auth(), but in the meantime a workaround is setting config.cookies.sessionToken.name to your desired salt (not sure about any security implications).

I'm probably missing something, or it's all just WIP, fater all it says "under active development" on the box...

[nghianguyen119]

FYI, if you are utilizing a custom cookie name, you must convey both the cookie name and the corresponding salt (assuming it is the same as the salt).

await getToken({
    req,
    secret: process.env.AUTH_SECRET!,
    secureCookie: false,
    cookieName: "next-auth.session-token",
    salt: "next-auth.session-token",
  })

[slavabez]

Just sharing my working implementation in case it might be useful for anybody. I'm using this in the middleware.ts file. Versions: [email protected] and [email protected]

  const token = await getToken({
    req,
    secret: process.env.AUTH_SECRET!,
    secureCookie: process.env.NODE_ENV === "production",
    salt:
      process.env.NODE_ENV === "production"
        ? "__Secure-authjs.session-token"
        : "authjs.session-token",
  });`

[Mahmoud3bas]

I looked into the code of the getToken method and I discovered that the salt param defaults to the cookieName, which is the same that we have in the solutions above, but it's required in the type which is weird. I think there is an issue in the typing of this method.

I tried to use it without the param and it worked! Just got to ignore the ts error.
But I don't think that it's a good idea.

[yuanbo07]

Thanks a lot @slavabez this works !

[alireza-asgharii]

Yes, the only problem was giving it a name (v5: authjs.session-token ,...). The problem was actually solved.

[chtpl]

I think I have a similar problem decoding the token - could someone maybe have a look at my code and tell me what I'm doing wrong please? I posted my code here: #11811

[chtpl]

so it turned out that we need to set both the salt and the secret as env vars in both the frontend and the backend. using the default cookie name as salt simply did not work