Use of JWT callback to persist additional token info results in session being null.

[msardi23]

I am using the JWT callback to add additional information to the token like access_token, refresh_token and expires_at as outlined in the Auth.js docs here for the JWT callback and here for refresh token rotation.

While I have this working fine using Next.js 13 and Qwik, I have been struggling with Astro. As soon as I include logic in the JWT callback to enhance the token the session ends up being empty. When I remove the enhancement in the JWT callback the default session data is returned.

No errors are reported in the console. I am using the Azure AD provider.

export default {
  secret: import.meta.env.AUTH_SECRET,
  trustHost: true,
  providers: [
    AzureAd({
      clientId: import.meta.env.AZURE_CLIENT_ID,
      clientSecret: import.meta.env.AZURE_CLIENT_SECRET,
      tenantId: import.meta.env.AZURE_TENANT_ID,
      authorization: {
        params: {
          scope: "...removed...",
        },
      },
    }),
  ] as Provider[],

  callbacks: {
    async session({ session, token }) {
      if (token) {
        session.access_token = token.access_token;
      }
      return session;
    },
    async jwt({ token, user, account, profile, isNewUser }) {
      if (account) {
        token.access_token = account.access_token;
      }
      return token;
    },
  },
};

If I then check session via .../api/auth/session it returns an empty object.

If I comment out token.access_token = account.access_token; in the JWT callback the default session data is returned.

Same issue occurs using both JS and TS projects.

Please help 😀

[dvartdal]

I have somehow a similar issue @msardi23 . However, for me, it works when only adding the account.access_token in my token, however, adding both the access_token and the refresh_token gives me the same error as you, where the getSession() returns null.

Not adding the refresh_token makes the getSession() return an existing session.

This is my code that works, and I have commented out the line adding the refresh_token to the token object for reference.

import AzureADB2C from '@auth/core/providers/azure-ad-b2c'
import { defineConfig } from 'auth-astro'

export default defineConfig({
	providers: [
		AzureADB2C({
			issuer: `https://${import.meta.env.AZUREADB2C_TENANT}.b2clogin.com/${
				import.meta.env.AZUREADB2C_TENANT_ID
			}/v2.0/`,
			wellKnown: `https://${import.meta.env.AZUREADB2C_TENANT}.b2clogin.com/${
				import.meta.env.AZUREADB2C_TENANT
			}.onmicrosoft.com/${import.meta.env.AZUREADB2C_POLICY}/v2.0/.well-known/openid-configuration`,
			authorization: {
				url: `https://${import.meta.env.AZUREADB2C_TENANT}.b2clogin.com/${
					import.meta.env.AZUREADB2C_TENANT
				}.onmicrosoft.com/${import.meta.env.AZUREADB2C_POLICY}/oauth2/v2.0/authorize`,
				params: {
					scope: `YOUR SCOPES`
				}
			},
			token: `https://${import.meta.env.AZUREADB2C_TENANT}.b2clogin.com/${
				import.meta.env.AZUREADB2C_TENANT
			}.onmicrosoft.com/${import.meta.env.AZUREADB2C_POLICY}/oauth2/v2.0/token`,
			clientId: import.meta.env.AZUREADB2C_CLIENT_ID,
			clientSecret: import.meta.env.AZUREADB2C_CLIENT_SECRET,
			allowDangerousEmailAccountLinking: true
		})
	],
	callbacks: {
		async signIn({ user, account, profile, email, credentials }) {
			if (profile) {
				if (user) {
					user.email = profile.email
				}
			}
			return true
		},
		async jwt({ token, user, account, profile }) {
			if (account && user) {
				const newToken = {
					accessToken: account.access_token,
					accessTokenExpires: Date.now() + account.expires_in! * 1000,
					// refreshToken: account.refresh_token,
					user
				}

				// console.log(newToken)
				return newToken
			} 

			// Return the current token if it's not expired or if there was no account object
			return token
		}
	}
})

For me, it seems that also adding a request token, maxes out the token size limit, or something. Because if I only add, for example: refreshToken: "refresh token", it works, and session is set.

From what I can see, from the Astro.request and the request cookies, the authcookie is not set when adding the full refreshToken, but is set when only adding accessToken.

The cookies remaining are: "authjs.csrf-token" and "authjs.callback-url" which for me, seems that something has happened when prosessing the extra data. The authjs cookie: "authjs.session-token" is missing.

When removing refreshToken so the session is not null anymore, the request header looks correct with the "authjs.session-token" cookie now in place.

I haven't calculated the size, but we might be hitting the browser cookie size limit (4kb). I know they have done something for this limitation for NextAuthJs:

https://github.com/nextauthjs/next-auth/discussions/3579#discussioncomment-1929584

Edit: Seemed to only work in dev. Built in prod or preview; session cookie is not set at all when doing changes in the callback as @msardi23 mentioned.

[nowaythatworked]

I just tested this on the latest astro, @auth/core and auth-astro version without any issues. Do you still have this problem?

[dvartdal]

I'm using my own version setting the refresh cookie in a separate cookie. However, I'll see if I can take a look at it and test!