search

get-convex / convex-auth

Library for built-in auth
https://labs.convex.dev/auth
51 stars 15 forks source link

Consider: Using long-lasting JWTs and always validating the session #20

Open xixixao opened 4 months ago

xixixao commented 4 months ago

This would obviate the need for refresh tokens.

tristanz commented 1 month ago

This would simplify server side rendering. The refresh token significantly complicates server side rendering + client auth code since refreshing can both happen on the backend for preloadQuery token and in the convex client to keep it alive.

sshader commented 1 month ago

Still considering this, but for now have implemented a 10s reuse window (similar to what supabase does) to guard against some of the races with SSR.