Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AUTH_INVALID_ACCESS_TOKEN in page endpoints using Prisma adapter #35

Closed
MichiOnGithub opened this issue Aug 2, 2022 · 4 comments
Closed
Labels
documentation Improvements or additions to documentation

Comments

@MichiOnGithub
Copy link

Hi,

I'm unsure how to fix this error when accessing data in load function/page endpoint.
The docs say:

The access token should be send as a bearer token in the authorization header. Lucia does not rely on http-only cookies to verify the user in endpoints to prevent CSRF attacks.

How would this work with the a page endpoint that calls e.g.

export const GET: RequestHandler = async ({ request }) => {
	try {
		await auth.validateRequest(request);
		...

Thanks for your help!

@pilcrowOnPaper pilcrowOnPaper added the documentation Improvements or additions to documentation label Aug 2, 2022
@pilcrowOnPaper
Copy link
Member

This seems like something that should be explained in the docs. I'm going to handle this as an issue with the docs.

Anyway, the fetch request should be sent like this:

await fetch("/some-endpoint", {
    headers: {
        Authorization: `Bearer ${access_token}`
    }
}

@MichiOnGithub
Copy link
Author

MichiOnGithub commented Aug 2, 2022

Thank you for the fast reply!
Maybe I didn't explain it well enough, I'm not talking about using fetch for an endpoint but using a page-endpoint. As this is called directly on navigation, I'm not sure we can set auth headers here

@pilcrowOnPaper
Copy link
Member

Oh, yeah, my bad.

Unfortunately, you'll need to create a load function for the page and send a request from it.

@pilcrowOnPaper
Copy link
Member

With the recent 0.5.1 update, you can use validateRequestByCookie to validate requests using cookies, so no load functions needed!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Improvements or additions to documentation
Projects
None yet
Development

No branches or pull requests

2 participants