How to sign out the user from server side (getServerSideProps)

[igpe]

Question 💬

What would be considered proper way to sign out the user from the server side, like from getServerSideProps?
Is it safe to just expire next-auth.session-token cookie (using name that is set under cookies sessionToken options)? I am aware this would not trigger signOut event.

Sending POST request to /api/auth/signout (with csrfToken) does not produce expected result from server side. Id does work fine when called from client.

How to reproduce ☕️

Simple question. No code needed.

Contributing 🙌🏽

No, I am afraid I cannot help regarding this

[ThangHuuVu]

We've been receiving some feedback about having signOut on the Backend, but haven't decided yet about the API 🤔
Our best option so far is to have a "signOut" action, similar to our unstable_getServerSession API

next-auth/packages/next-auth/src/next/index.ts

Line 95 in 49a8d51

action: "session",

Prolly we will release it in an experimental fashion in the near future. 🤞

[peppescg]

Hi @ThangHuuVu is there an update on this issue? In my use case I need to signout in case of 401 API response, and I want to handle it on the server rather than client
Actually I am redirecting to a client Logout page and signOut, but this means unneeded redirect and waste of time from a UX perspective

[nelsonmandeladev]

Hello @peppescg, I think there is a work arround on this that has come out with the latest update where you can signIn our signOut on the server side, for that you need to update to version "next-auth": "^5.0.0-beta.16",,

npm install next-auth@beta

Then in your auth-config.ts file you can do this. Note that I'm using the database to persist the session instead if cookies and that why you can see the adapter config here. So you can securly remove it:

import NextAuth from "next-auth"
import { PrismaAdapter } from "@auth/prisma-adapter"
import prisma from "./prisma"
import GoogleProvider from "next-auth/providers/google"
import FacebookProvider from "next-auth/providers/facebook"

export const { handlers, auth, signIn, signOut } = NextAuth({
    adapter: PrismaAdapter(prisma),
    providers: [
        GoogleProvider({
            clientId: process.env.AUTH_GOOGLE_ID,
            clientSecret: process.env.AUTH_GOOGLE_SECRET
        }),
        FacebookProvider({
            clientId: process.env.AUTH_FACEBOOK_ID,
            clientSecret: process.env.AUTH_FACEBOOK_SECRET
        })
    ],
    pages: {
        signIn: "/login"
    }

})

Finaly just call any of the exported methodes in the server rendered code, for the client render code you can keep using the signIn or signOut from next-auth/react, Also don't forget to use with async...await

You can find more here: https://authjs.dev/getting-started/installation?framework=next.js

[peppescg]

@nelsonmandeladev oh that's amazing, thanks for the heads-up 🙏
I will makes a couple of tests with the beta.

[nelsonmandeladev]

@peppescg Your are welcome 🤗

[mardrof]

Hi @ThangHuuVu. Do you have any new informations when signing out from backend side will be possible? :)

[ThangHuuVu]

@mardrof we have an ongoing RFC here: #6246
First step is to test the idea of getting the session first, and then we'll add support for mutation like login and log out gradually

[NikkiMather]

Any update on this? I'm currently using the Credentials provider and managing a users session is very odd, even if you are purposely discouraging us from using user/pass logins. Since NextAuth doesn't respect the maxAge property set in ...[nextauth] and keeps extending the users session, I have to set the 'real' token expiry date when the JWT gets allocated, then check it in the session callback. I was hoping to just use signOut once the date of my own token expiry goes by and even though it does work, it also gives errors about the window object, naturally...

I've spent countless days trying to get this working on an enterprise app and it seems like NextAuth just really doesn't want me using the Credentials provider so much, that you're purposely making it difficult to use. Ugh.

[Khaaz]

I also need server side logout..
In my case I need to fetch a data from my backend and depending the result, it should logout the user.
I want to do that server side as I want to make sure users correctly logout when they should.

I can't really use JWT / Session callbacks are they are called a lot. in my case I really juste want to do the verification once (on every refresh basically)

Any plan for this to actually be a thing? Or potential workarounds?

[wahyunurarizky]

hello, any info for this?, I have same question

[nelsonmandeladev]

Hello @wahyunurarizky, I had the same problem, but in my case, I wanted to log out the user when the backend API JWT token expired as I'm using a single fetch instance I created for the entire project. Also as for the project I opted to use server action for API calls and data fetching but the signout function seems to be a hook meaning it can't be called on the server side, so, to handle this I created a standalone client page log out page and use redirect("/auth/logout"); in my fetch method. the one the log out page is called I then call the the signout in the useEffect hook useEffect(() => { signOut({ redirect: true, callbackUrl: '/auth/login' }); }, []);.

It's a bit weird but for now it solves my problem.

[AlexisKenAlvarez]

Thank you! This works for me

[dekiakbar]

@wahyunurarizky hi, where you put this code ? I have tried in api handler and in middleware but getting error

[wahyunurarizky]

i put in api handler, it should be work either in middleware

[enyelsequeira]

hey @wahyunurarizky does this log you out? and clear the cookies? I have something like this

[mdahiemstra]

Probably a good idea to verify the csrf token here e.g.

  const csrfTokenClient = cookies().get('next-auth.csrf-token');
  const [csrfToken, csrfTokenHash] = csrfTokenClient.value.split('|');

  const expectedCsrfTokenHash = createHash('sha256')
    .update(`${csrfToken}${process.env.NEXTAUTH_SECRET}`)
    .digest('hex');

  if (csrfTokenHash !== expectedCsrfTokenHash) {
    // do stuff
   }

[DevYemi]

Please is there any new update on this ?

[leonimurilo]

Any update on this? Disappointing for such a simple thing to be so inelegant

[HabibMollah]

Man, I am in soo need of this rn.

[jealouscase]

Would be awesome if we could get an update on this 🙏

[mdahiemstra]

Probably a good idea to verify the csrf token here e.g.

const secureCookie = process.env.NEXTAUTH_URL?.startsWith('https://');
const cookiePrefix = secureCookie ? '__Secure-' : '';

const csrfTokenClient = cookies().get(`${secureCookie ? '__Host-' : ''}next-auth.csrf-token`);
const [csrfToken, csrfTokenHash] = csrfTokenClient?.value?.split('|');

const expectedCsrfTokenHash = createHash('sha256')
  .update(`${csrfToken}${process.env.NEXTAUTH_SECRET}`)
  .digest('hex');

if (csrfTokenHash !== expectedCsrfTokenHash) {
  // do stuff
}

Btw, it seems like a bad idea to clear the cookies yourself, but if you do you also need to consider the secureCookie prefix in next-auth:

const cookieNames = [
  `${cookiePrefix}next-auth.session-token`,
  `${cookiePrefix}next-auth.callback-url`,
  `${secureCookie ? '__Host-' : ''}next-auth.csrf-token`,
];

cookieNames.forEach((cookieName) =>
  cookies().set(cookieName, '', {
    expires: new Date(Date.now()),
    secure: secureCookie,
    httpOnly: true,
    sameSite: 'none',
  })
);

[CromulentCoder]

Plus one for the feature. It seems like a much needed feature for anyone using a backend different from their next-auth authentication to be able to logout users from server side on JWT expiry/ invalidation.

[Jared-Dahlke]

plus one for needing to be able to logout user server side. Using latest app dir.

[Jared-Dahlke]

can we just clear all of our cookies to logout?

[seiscordas]

I don't understand why it is so hard to do this.
In my mind we only have to do this on server side: "await signOut();"
Why it is not simple like this?

[CRIMSON-CORP]

Im also stuck on this, i even thought it exists, just realizing it doesnt

[nelsonmandeladev]

Only at your own risk ⛔️

[CRIMSON-CORP]

Hehe exactly, i do hope the feature gets stable as soon as possible, my only option is to set next auth session expiry a little sooner than when the token expires on the backend

[peppescg]

Hi @nelsonmandeladev, are you able to run the next-auth": "^5.0.0-beta.17" version calling signout on a server action 🤔 ?
Cause I got an error described here based on the fact that seems the cookies are deleted not on a server action, but that's not possible.

[seiscordas]

Hi CRIMSON-CORP!
How did you do this "my only option is to set next auth session expiry a little sooner than when the token expires on the backend"? could you please share de code?

[CRIMSON-CORP]

jwt: { maxAge: 60 * 30, // let it match backend token expiry time },

add this to your next auth options

The user token on our backend expires every one hour, so setting the max age of jwt on next auth to the same one hour logs the user out of the application before they can make any request that would eventually give a 401 and crash my application

[Jared-Dahlke]

Docs or it didn’t happen Sent from [Proton Mail](https://proton.me/mail/home) for iOS

…

On Sun, May 5, 2024 at 3:02 AM, Sonfack Nelson Mandela ***@***.***(mailto:On Sun, May 5, 2024 at 3:02 AM, Sonfack Nelson Mandela <<a href=)> wrote: Hey ***@***.***(https://github.com/CRIMSON-CORP) have you tried the latest version of next-auth now authjs ? It's still in beta but it's now possible to sign out from the server. — Reply to this email directly, [view it on GitHub](#5334 (reply in thread)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AH3JIEUSX25IG3EJ4VHZPM3ZAX7TNAVCNFSM6AAAAAAQKS77CKVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TGMJYHE4DI). You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[OliXVIII]

First step:
Clear browsing data (Clear history, cookies, cache, and ...) - All time