[SDK-3332] Constrain session lifecycle to withPageAuthrequired to avoid Next warning

[adamjmcgrath]

Description

Next.js >=12 have started to issue a warning (You should not access 'res' after getServerSideProps resolves.), and in some cases an error, when you access the response object after getServerSideProps has run.

Because this SDK provides a rolling session by default, it writes to the response at the end of every request. It does this at the end of the request using on-headers, which causes the warning because on-headers executes after getServerSideProps resolves.

We can fix this in withAuthenticationRequired by not using on-headers and writing to the headers just before withAuthenticationRequired completes, eg.

async function withAuthenticationRequired({ getServerSideProps }) {
  session.get(disableOnHeaders=true) // read cookie and disable on-headers
  //  ... existing code ...
  session.save() // write cookie (because on-headers is disabled)
}

If you want to use getSession (and getAccessToken) without requiring auth on your route, you'll still need to use the withAuthenticationRequired wrapper, but you can do this now with the authRequired: false option. eg

export const getServerSideProps = withAuthenticationRequired({
  authRequired: false,
  async getServerSideProps(ctx) {
    const session = getSession(ctx.req, ctx.res);
    if (session) {
      // user is logged in
    } else {
      // user is not logged in
    }
  }
});

I also fixed an issue in withAuthenticationRequired when props is a Promise, eg

function getServerSideProps() {
  return { props: Promise.resolve({}) }
}

References

https://nextjs.org/docs/messages/gssp-no-mutating-res
fixes #524

Testing

Run the basic example app and notice that there is no warning when visiting /protected

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not main

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Ignored Deployment

Name	Status	Preview	Updated
nextjs-auth0	⬜️ Ignored (Inspect)		May 18, 2022 at 3:24PM (UTC)

[Widcket]

Is an authRequired option on withAuthRequired the best way to go? It kind of defeats the entire purpose of withAuthRequired. Should we go with a different wrapper instead?

[adamjmcgrath]

I thought about that (eg withPageAuth or withSessionInitialised etc) - but decided this would be the easiest to grok

[Widcket]

I'm not sure that should determine the design of this feature (documenting it well along with a clear name can make it easy to grok as well). I'll leave it up to you.

[adamjmcgrath]

Let me give it another thought, I'll see if I can come up with a good name

[adamjmcgrath]

I went for getServerSidePropsWrapper in e523099 (wait until after your day off to take a look :P)