Skip to content

Session cookie refresh #2349

Open
Open
@francescovenica

Description

@francescovenica

Hello I'm using Firebase Auth (actually gcp identity platform) with the session cookie in a NextJS app, everything is working fine but I'm looking a way to refresh the cookie to avoid forcing the user to login again when the session expire. There isn't an official way to do that but I might have found a solution, I'm just not 100% sure this is secure enough or if there are issues I'm missing, the idea is to have a refresh endpoint with this code:

    const idToken = req.cookies.session || req.body.sessionCookie;
    const session = await auth().verifySessionCookie(idToken, true);

    if (session) {
      const customToken = await auth().createCustomToken(session.uid);

      const response = await fetch(
        `${GOOGLE_API}:signInWithCustomToken?key=${process.env.NEXT_PUBLIC_API_KEY}`,
        {
          method: "POST",
          cache: "no-cache",
          headers: { "Content-Type": "application/json" },
          body: JSON.stringify({ token: customToken, returnSecureToken: true }),
        },
      );

      const result = await response.json();
      const sessionCookie = await auth().createSessionCookie(result.idToken, {
        expiresIn,
      });

      setCookie(res, "session", sessionCookie, {
        ...cookieOptions,
        maxAge: expiresIn,
      });

      return res.json({ session, customToken, sessionCookie });
    }

then every time I want I can call this refresh endpoint and the session will be updated...it seems to work but I'd like to have some feedback on this.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions