Issues when api-domain and auth-domain are on different ports

[djuelg]

You provide the possibility to have different backends for the api-endpoints and auth-endpoints, by configuring sessionTokenBackendDomain. In our environment the two systems run on the same domain, but on different ports.

When you try to authenticate your Dio api-requests via SuperTokensInterceptorWrapper, the method shouldRunDioInterceptor will return false, when the ports differ, leaving the requests unauthenticated. The causing code is:

    if (SuperTokensUtils.getApiDomain(options.uri.toString()) !=
        SuperTokens.config.apiDomain) {
      return false;
    }

In my example the two values would evaluate to:

• SuperTokensUtils.getApiDomain(options.uri.toString()) -> https://example.com:65000/ (which is the api-backend)
• SuperTokens.config.apiDomain) -> https://example.com:3000/ (which is the auth-backend)

Using the following config:

    SuperTokens.init(
        apiDomain: 'https://example.com:3000/',
        sessionTokenBackendDomain: '.example.com/');

This issue prevents the sessionTokenBackendDomain from being evaluated. Wouldn't it be sufficient to rely on the following check only?

    if (!Utils.shouldDoInterceptions(
        options.uri.toString(),
        SuperTokens.config.apiDomain,
        SuperTokens.config.sessionTokenBackendDomain)) {
      return false;
    }

[rishabhpoddar]

I see. The issue is that our implementation does not take into account different ports. You have two options:

• When making a request to your application domain, you can fetch the access token using this function, and then add this as an authorization bearer token to your request. Our SDK auto refreshes the token if needed before returning one to you.
• You can make a PR to our SDK which allows users to set their own implementation of shouldDoInterceptions via a config prop which will be used instead of our default implementation.

[djuelg]

For the moment I just extended from SuperTokensInterceptorWrapper to override shouldRunDioInterceptor. But when I find the time, I'll look into creating a PR :)