getSession doesn't return sessionToken

[roosnic1]

I implemented a custom adapter which works with an existing backend. Everything seems to work but if i call getSession({req: ctx}) i'm only getting:

{
  user: { name: 'User Name', email: 'user@email.com' },
  expires:  '2021-10-06T18:03:37.362Z'
}

Is there a reason why i don't see the sessionToken. In the callback session({user, token, session}) i also don't see the sessionToken. JWT are disabled in the options. Is this by design or am i doing something wrong?

[balazsorban44]

why would you need that? it's not something exposed directly, and shouldn't be either.

[balazsorban44]

FYI, in the future, we might even hash that sessionToken to make it even harder for the frontend to sniff after the session in the database.

[roosnic1]

I have a backend with a GraphQL API. Through my custom adapter i create a session in that backend and use the generated token as sessionToken in next-auth. My next.js app then uses GraphQL ApolloClient to access the same backend through server side GraphQL calls and direct client GraphQL calls. Some of those calls need to be authenticated.

[balazsorban44]

I am no security expert so take these words with a grain of salt...
But what I have seen is that usually, you don't want to send around the session identifier in your app. A more usual flow is that your identity server creates an access_token (in most cases a JWT), signs it, and sends that to the user, which you can attach to API requests from your client. Those backend APIs should have a way to decode the token and verify its integrity.

Nevertheless, the sessionToken is readable from your Next.js backend, from req.cookies. So you could proxy your client-side requests through an API route and use the sessionToken there.

[roosnic1]

Thank you very much for your help. I'll exactly do that. Do you think this will still be a usable solution once next-auth starts hashing the sessionToken?

[balazsorban44]

I'll have to learn more about how we can do that correctly, but I'm guessing it will be possible to retrieve the original value server-side