Requests made when a JWT token expires always fail (Supabase v2)

[alexreyes]

Bug report

Describe the bug

Making a request right when a JWT token expires results in a 400: JWT expired error on React Native iOS. This only happens exactly as the token is expiring, and subsequent requests seem to work.

I think this might also be causing the random logging out issues as well.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Set the JWT expiry timeout to 5 seconds
2. Make a request as the JWT token expires (every 5 seconds)
3. See JWT expired error message

NOTE: making a second request after getting the JWT expired error later results in that second request working.

Expected behavior

I would expect the token to be refreshed before making the request and the request to work fine.

Screenshots

System information

• OS: macOS
• Browser: React native iOS
• Version of supabase-js: ^2.0.0
• Version of Node.js: v16.13.1

Additional context

[neocho]

Good question: curious about this too

[hf]

Hey we're tracking this issue internally. We did some changes to the way expiration is handled in v2 (i.e. removed a safety margin that was previously there). But I think it's time to bring it back now, as it clearly is not behaving as well as we hoped. I'll submit a PR right now.

[alexreyes]

@hf okay thanks! When you submit the PR, could you please link it here? Would love to test it and give feedback (and maybe switch to the PR branch if it fixes it).

For context, this is causing data loss for our users where they make an action on the app and don't see it reflected once they refresh/reopen/etc

[hf]

This is the PR (that was contributed by another member of the community a few days ago). #482

[hf]

If you could leave your review on it that would be great since it's going to take at least one day before we can deploy a fix to this.

[hf]

Hey @alexreyes, just sanity checking -- you're setting the JWT expiry to 5 seconds only to test this behavior right? We don't recommend setting an expiry time of less than 2-3 minutes on it, except for testing purposes like this.

[alexreyes]

Yup, it’s just for testing. Normally I set the expiry to 1 hour

…

On Fri, Oct 14, 2022 at 12:22 PM Stojan Dimitrovski < ***@***.***> wrote: Hey @alexreyes <https://github.com/alexreyes>, just sanity checking -- you're setting the JWT expiry to 5 seconds only to test this behavior right? We don't recommend setting an expiry time of less than 2-3 minutes on it, except for testing purposes like this. — Reply to this email directly, view it on GitHub <#487 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABVRBXOYXTIYYFF5TLSFYRTWDGXGZANCNFSM6AAAAAARERAIDM> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[alexreyes]

@hf I tried it, and I still had the same problem of the request failing because of JWT expiry when using the changes linked in the PR. Do you have any other ideas what might be causing this?

[hf]

I tried it, and I still had the same problem of the request failing because of JWT expiry when using the changes linked in the PR.

That's unfortunate...

Do you have any other ideas what might be causing this?

It's difficult to tell since the auto refresh code is a bit messy. I guess we have to do a refactor of ti sooner.

[alexreyes]

I ended up figuring out why this bug was happening! Turns out, it had nothing to do with Supabase and instead was due to the way react renders things.

The situation:

I am updating the JWT token in a useEffect() in the context file for my project. There are times when the JWT token updates in the context, and this updated token isn't being passed down and reflected in the child component where the API request is made.

The solution:

I use await supabase.auth.getSession(); to retrieve the JWT token before making API calls instead of getting the session from the context

[alexreyes]

@hf Actually, #482 did partly fix the issue. I just tried the same thing without the contents of that PR, and I got the JWT expired error.

So the PR changes are needed to fix this issue

[hf]

That's reassuring because we were discussing about finding some time to squeeze a refactor of the auto refresh code. 😅