Changes due to cookie (that are set on the client side) expiration capped to 7 days

[rishabhpoddar]

• On browsers like safari and brave, cookies set on the client side are caped to 7 days expiry (https://www.cookiestatus.com/)
• This means that tokens like frontToken, or idrefreshtoken, or anticsrftoken that are set in cookies will be deleted after 7 days.
• We can use localstorage instead, but this means that working across sub domains will not be possible:
  • We can create an API on the backend that says if a session exists or not. If it does, then it will set these tokens in localstorage. But this has an issue that if these tokens are deleted from one sub domain's localstorage, they will persist in the next sub domain's localstorage (even if the session doesn't exist).
  • In case the user is using an anti-csrf token, then the new suddomain cannot get that token at all.
• We can continue to use cookies and also have an API in case no cookies exist (after 7 days)
  • This will work well, as long as the user is not using anti-csrf tokens, since after 7 days, that anti-csrf token will be missing, and can't be recovered -> which will yield a logout.

---

Finally, we decided to go with an iframe method that will allow us to share localstorage across sub domains.

---

TODO:

• [x] Changes to supertokens-website
• [x] Changes to auth-react
  • [x] Types changes
  • [x] Using hooks to expose userInfo: https://github.com/supertokens/supertokens-auth-react/issues/49
• [x] Changes to docs
  • [x] function sign change to getUserId and to doesSessionExist (they both are now async)
  • [x] context usage
  • [x] requireAuth boolean in Auth wrapper and session wrapper

[rishabhpoddar]

The most full proof solution seems to be based on using an iframe and storing information in that iframe's localstorage