Middleware callback function authorized is not using updated token.

[bejenaru-victor]

Description 📓

I am using authjs's middleware to protect all pages and have the following configuration in my middleware.js at the 'app' directory level:

import { getToken } from "next-auth/jwt"
import withAuth from "next-auth/middleware"
import { getServerSession } from "next-auth/next"


export default withAuth({
    pages: {
        signIn: '/login',
        error: '/login',
    },
    callbacks: {
        authorized({ req , token }) {
            console.log(token)
            if(token.access) return true // If there is token.access, the user is authenticated
        }
    }
})

At the login, I am using the JWT strategy and I have a backend where I get the access_token and refresh_token. In the new documentation, it is recommended that you deal with the refresh token rotation at the JWT callback function.

https://authjs.dev/guides/basics/refresh-token-rotation

The problem:

The middleware function doesn't seem to call the JWT callback, therefore if the access token expires, in the authorized callback, the token is outdated.

Feature request:

In the authorized callback, as well as custom middleware function, make the token parameter up to date by running the JWT callback so in the case that access token is expired, the rotation to be handled in the JWT callback and the middleware to have the up to date token

How to reproduce ☕️

.

Contributing 🙌🏽

No, I am afraid I cannot help regarding this

[lasota-piotr]

I am facing the same problem. Has anyone found a solution yet?

[naimo84]

I'm also facing The problem, my refreshtoken I'm getting in the jwt callback does not update... Therefore I can update my accesstoken only once.

[codeAdityagithub]

I got it working with custom cookie check, to get session token:

export default withAuth({
    jwt: {
        decode: ({ secret, token }) => {
            return jwt.verify(token!, secret);
        },
    },
    callbacks: {
        authorized: ({ token, req }) => {
            const cookie = req.cookies.get("next-auth.session-token")?.value;
            // console.log(cookie, "cookie");
            return !!cookie;
        },
    },
});

[BpopRcontact]

I am facing the same issue. If the refresh token flow fails, I want to add an error property (as mentioned in the documentation), but the token in the middleware does not contain this property.

[ariendegroot]

I am also facing this issue. In the middleware I cannot acces an error property when a Refresh token flow is not working:

        try {
          const response = await fetch(
            `${url}`,
            {
   ...config for oauth endpoint
            }
          )

          const newToken: any = await response.json();
          if (!response.ok) throw newToken
          return {
            ...token, // Keep the previous token properties
            id_token: newToken.id_token,
            expires_at: Math.floor(Date.now() / 1000 + newToken.id_token_expires_in),
            // Fall back to old refresh token, but note that
            // many providers may only allow using a refresh token once.
            refresh_token: newToken.refresh_token ?? token.refresh_token,
            error: "test"
          }
        } catch (error) {
          token.error = "RefreshAccessTokenError";
          // The error property will be used to handle the refresh token error in middleware.ts
          // But the error property is nog available on middleware.ts
          const returnObject = { ...token, userName: 'RefreshAccessTokenError' as const }
          console.log("Error is available in this returnobject", returnObject);
          return token
        }

And the middleware function:

const authMiddleware = withAuth(
  function middleware(req) {
    return intlMiddleware(req);
  },
  {
    callbacks: {
      authorized({ token }) {
        console.log("Token from middleware", token);
        // token.error is Never available here
        if (token) {
          console.log(token.error);
          return !token.error || token?.error !== 'RefreshAccessTokenError'
        } else {
        // return false if token is not available
          return false
        }
      },
    },
    pages: {
      signIn: '/api/auth/signin',
    },
  }
);