supabase / auth-js

An isomorphic Javascript library for Supabase Auth.
MIT License
318 stars 152 forks source link

Session from session_id claim in JWT does not exist #914

Closed nicetomytyuk closed 3 weeks ago

nicetomytyuk commented 3 weeks ago

Bug report

Describe the bug

When I try to use the setSession() I get a response error like: "Session from session_id claim in JWT does not exist", by trying to decode the JWT token, I am able to see that it has the session_id. The authentication is create in two steps, signInWithPassword() in a project similar to "Google Auth" which then do a redirect to another project with the access_token and refresh_token in the query strings, that then is consumed and set in the setSession().

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Create a project with a basic login that uses the signInWithPassword()
  2. When the authentication is successful, redirect to another project with the session.access_token and the session.refresh_token
  3. When redirect, fetch the access_token and the refresh_token from the query string and use setSession().
  4. The setSession() at that point will return:

    { "code": 403, "error_code": "session_not_found", "msg": "Session from session_id claim in JWT does not exist" }

Expected behavior

The setSession() must return a valid session instead of error 403.

Screenshots

image

System information

Tried with the following version of auth-js: 2.64.2 and the 2.61.0 (This one is prefered as it prevents the LockManager error in Angular).

nicetomytyuk commented 3 weeks ago

Closing this issue as in the authentication application, after the signInWithPassword() and the redirect, there was a signOut() by removing it and by handling the signOut() only from the main application and not the auth, resolve the issue.