fix(core): honor session.updateAge for JWT strategy re-signing#13424
Open
Zelys-DFKH wants to merge 2 commits into
Open
fix(core): honor session.updateAge for JWT strategy re-signing#13424Zelys-DFKH wants to merge 2 commits into
Zelys-DFKH wants to merge 2 commits into
Conversation
The JWT strategy in the session action re-signed and re-set the session token cookie on every request, ignoring `session.updateAge`. The database strategy already throttled writes with the same option. This applies the same formula to the JWT branch: (token expiry - sessionMaxAge) + sessionUpdateAge <= now When the condition is false, jwt.encode() and the Set-Cookie header are skipped. A forced update (isUpdate) or a token without an `exp` claim always re-signs regardless of the window. Tests: updated the existing JWT session test to reflect correct behavior (fresh tokens are not re-signed), and added two regression tests that verify the throttle boundary. Fixes nextauthjs#13248
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
|
@Zelys-DFKH is attempting to deploy a commit to the authjs Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #13248
Summary
`session.updateAge` throttles how often the session token is refreshed. The database
strategy already respects it (since v4), but the JWT strategy ignores it entirely,
re-signing and resetting the cookie on every single request.
What this does
Mirrors the throttle logic from the database branch into the JWT branch:
```
(payload.exp * 1000) - (sessionMaxAge * 1000) + (sessionUpdateAge * 1000) <= now
```
When the condition is false, `jwt.encode()` and `sessionStore.chunk()` are skipped.
The response body is unchanged: `expires` still reflects the full `sessionMaxAge`
window regardless of whether we re-sign.
Tests
Two regression tests added to `session.test.ts`:
All 148 tests pass.
Checklist