Session still present in API route check after client side signOut

[kramer99]

Question 💬

I expect there's an option somewhere I'm missing, but I haven't managed to find it after scouring the documentation and closed issues for the past two hours.

I have client side signOut working fine via:

import { signOut, useSession } from 'next-auth/react';

const Header = () => {
  const { data: session } = useSession();

  const onClick: any = signOut;

  return (
    <Navbar bg="dark" variant="dark" className="page-header sticky-top">
...
      <Button className="btn btn-secondary btn-sm" onClick={onClick}>
        Logout
      </Button>
      <Notification />
    </Navbar>
  );
};

I'm also trying to protect an API route using the guidance here: https://next-auth.js.org/tutorials/securing-pages-and-api-routes#using-getsession

I'm using a wrapper function, but it's the same result if I put the session check directly in the API route:

export default function withAuth(handler: NextApiHandler) {
  return async (req: NextApiRequest, res: NextApiResponse) => {
    const session = await getSession({ req });
    // const s = await getServerSession({ req, res }, options);
    // console.log(s);
    if (session) {
      // Signed in
      console.log('Session', JSON.stringify(session, null, 2));
      await handler(req, res);
    } else {
      // Not Signed in
      res.status(401);
    }
    res.end();
  };
}

Now, what I'm seeing is that on signing out, my pages are protected and redirect to the signin url, as expected, however, calling the API route via Postman - without passing any header cookies - the API route still sees an active session.

I'd expect that after signout, the session being logged above should be null.

Probably not important, but for completeness, here is my [...nextauth].ts

import type { NextApiRequest, NextApiResponse } from 'next';
import NextAuth from 'next-auth';
import OktaProvider from 'next-auth/providers/okta';

const options = {
  providers: [
    OktaProvider({
      clientId: process.env.OKTA_CLIENTID || '',
      clientSecret: '', // not required with PKCE
      issuer: process.env.OKTA_ISSUER,
      checks: ['pkce', 'state'],
      client: {
        token_endpoint_auth_method: 'none'
      }
    })
  ],
  secret: ...
};

export default (req: NextApiRequest, res: NextApiResponse) =>
  NextAuth(req, res, options);

Thank you very much for any help.

How to reproduce ☕️

See above.

Contributing 🙌🏽

No, I am afraid I cannot help regarding this

[balazsorban44]

https://next-auth-example.vercel.app/ seems to be working fine. I suspect that your signOut only removed the cookie from your browser, and not from Postman. You will need to trigger a signOut from there, as it's a different "browser".