nextauthjs / nextauthjs/next-auth

Please document JWT session rotation

Open
#13,224 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

triage
Dominant language
TypeScript
Stars
28.4k
Forks
4k
PR merge metrics
No merged PRs in 30d

Description

What is the improvement or update you wish to see?

Apparently V5 automatically renews / rotates the JWT session cookie when it's nearing expiration when calling auth(). I can not find any documentation on this, while it is a major feature to be aware of.

The only mention of it I could find was in the middle of the "Disadvantages" section in the Session strategies page (emphasis mine):

Auth.js enables advanced features to mitigate the downsides of using shorter session expiry times on the user experience, including automatic session token rotation, optionally sending keep-alive messages (session polling) to prevent short-lived sessions from expiring if there is a window or tab open, background re-validation, and automatic tab/window syncing that keeps sessions in sync across windows any time session state changes or a window or tab gains or loses focus.

I came searching when I saw unexpected Set-Cookie headers in my network communication. This is a cool feature, but please document it. If there is documentation on it elsewhere, please link to it from the Session strategies page.

Additionally, every page in the docs contains a "Question? Give us feedback" link, but when I filled it, github-actions automatically closed it as incorrectly filled in. I guess the links should be updated.

Is there any context that might help us understand?

I want to fully understand how my authentication works, and unexpected / undocumented behavior, even if useful, makes me nervous. Specifically, I'd be interested to know when / how Auth.js decides to rotate the cookie.

Does the docs page already exist? Please link to it.

https://authjs.dev/concepts/session-strategies

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked Session strategies page and investigate the auth() behavior behind the unexpected JWT Set-Cookie headers. Document when and how session rotation occurs, link that explanation from the page, and review the docs feedback links in light of the related issue. Done means the behavior and feedback path are clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.