refreshed JWT token is not updated on the client

[violabg]

Environment

"next": "13.2.4",
"next-auth": "^4.20.1",

Reproduction URL

https://github.com/nextauthjs/next-auth-refresh-token-example

Describe the issue

I'm implementing the refresh token strategy as per the example on https://authjs.dev/guides/basics/refresh-token-rotation#client-side

I'm using credentialProvider, I'm able to obtain a new token and setting it on the jwt callback in [...nextauth].ts

if I console log the session on

async session({ session, token }) {
      session.user = token.user
      session.accessToken = token.accessToken
      session.error = token.error
      // console.log("session :>> ", session);
      return session
    },

I get the new token and eventually the error, so everything is working fine up to here.

on the client I'm using useSession() on a layout component that I share with all the pages:

  const { data: session } = useSession()

  useEffect(() => {
    if (session?.error === 'RefreshAccessTokenError') {
      signIn() // Force sign in to hopefully resolve error
    }
  }, [session])

but when I navigate to any page via Link (next/link), I can see the logs from async session({ session, token }) callback on the terminal whit the correct values, but on the client, session is always the old one, I need to do an hard reload of the page, in order to see the refreshed values

How to reproduce

Expected behavior

to be able to see the new value of useSession() when navigating the site, in order to logout the user if the token expires

[balazsorban44]

This is currently expected as the session is not re-fetched on the client whenever it changes on the server.

If you want to avoid doing a manual refresh, you can poll the session https://next-auth.js.org/getting-started/client#refetch-interval to make sure it's kept up-to-date with the server value.

Note, #7056 will introduce a more idiomatic way to update the session that might help with this case too.

Long-term, we would like to have built-in support for refresh token rotation.

[violabg]

Perfect, thanks

[violabg]

What if I want to logout the user directly on

async session({ session, token }) {
      session.user = token.user
      session.accessToken = token.accessToken
      session.error = token.error
      // console.log("session :>> ", session);
      return session
    }, 

What would be the correct way to do it?

[balazsorban44]

#7035

For now, just set some error and trigger signOut via the browser.