Unable to update the session using newly minted JWT token

[anshul-kai]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Although the JWT secret is exposed via the dashboard, one is unable to make use of it to update the session using the supabase.auth.setSession function. It ignores the changes made to the newly created & signed tokens.

What is the purpose of exposing the JWT secret if user-created tokens are being ignored?

To Reproduce

  import { createServerClient } from '@supabase/ssr';
  import { headers, cookies } from 'next/headers';

  const supabase = createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
    {
      cookies: {
        getAll() {
          return cookieStore.getAll();
        },
        setAll(cookiesToSet) {
          try {
            cookiesToSet.forEach(({ name, value, options }) => {
              cookieStore.set(name, value, options);
            });
          } catch (error) {
          }
        }
      }
    }
  );

  const {
    data: { session }
  } = await supabase.auth.getSession();

  const decoded = jwt.verify(
    session.access_token,
    process.env.SUPABASE_JWT_SECRET!
  );

  // Update expiry to 1 minute from now
  const newTokenJson = { ...decoded, exp: Math.round(Date.now() / 1000 + 60) };
  const newToken = jwt.sign(newTokenJson, process.env.SUPABASE_JWT_SECRET!);

  // No error is returned and the data object reflects the new token but auth.sessions table is not updated. A call to auth.getSession() continues to return the old values.
  const { data, error } = await supabase.auth.setSession({
    access_token: newToken,
    refresh_token: 'abc'
  });

Expected behavior

Create APIs/functions to override default token functionality ie. set expiration and renewal rules

1. One should be able to update/override the expiration of the current JWT token
2. One should be able to disable or intercept the auto-refresh functionality

System information

• OS: macOS
• Platform: Next.js
• Browser: Chrome
• Version of supabase-js: 2.45.2
• Version of supabase-ssr: 0.5.1
• Version of Node.js: 20.12.2

[j4w8n]

The setSession() method only affects the session for the local Supabase client; it does not contact the Supabase server with changes.

[anshul-kai]

Thanks @j4w8n! I think the core ask here is to have clear documentation on how to override the default session behavior. Think of a simple "remember me" functionality. How is one supposed to allow certain user sessions to expire sooner than others?

[j4w8n]

I think you'll have to wire up something yourself for that kind of feature. A "long time ago", I had my own Supabase auth helper with a remember me feature. Unchecked, the user would just have a session cookie; checked it would be a normal cookie with whatever lifetime value I used as a default; then, it defaulted to "checked" if you didn't use the feature.

Off the top of my head, I'm not sure how you'd work that into the ssr library, but I'm sure it's possible.