Auth.currentSession () don'ts work in SSR, when token expires

Describe the bug I use nextjs with amlify {ssr: true}. I extract token from req in getServerSideProps in this way:

async function getServerSideProps (context) {
  const { Auth }= withSSRContext(context);
  const session = await Auth.currentSession();
  ...
}

To Reproduce It works if user logged in recently. But if user closes the tab and opens it a few hours, this line will throw an error: const session = await Auth.currentSession()

The reason is clear: it happened because user’s tokens are not valid anymore. BUT int he documentation https://docs.amplify.aws/lib/auth/overview/q/platform/js#sign-up-and-sign-in I found that:

The Amplify client will refresh the tokens calling Auth.currentSession if they are no longer valid.

Seems that it doesn’t work on server side. It just throws an error without possibility to refresh tokens.

[ericclemmons]

Unfortunately, that’s expected behavior based on today’s implementation: the client handles the refreshing and the server is basically “read-only”:

https://github.com/aws-amplify/amplify-js/blob/8b3183f4d2ec7289044e2b6700e3ff4df3f98ce4/packages/core/src/UniversalStorage/index.ts#L87-L88

I agree, the server & client should work the same way. For some background, not saving the refresh token was done to get SSR working sooner, then get an httpOnly cookie solution working next.

I’m going to mark this as a feature request with the following action items for visibility, which of course will need to have its security posture reviewed:

1. Include refreshToken in UniversalStorage.

   1. Can this be shipped as-is, even without httpOnly cookies?

2. Update withSSRContext to include { res }, converting cookies to httpOnly.

[liamlevesqueP8]

So is there a way to work around this currently if trying to handle protected routes on the server (or do anything requiring auth on the servers)? Or do I have to revert to a client side implementation? Because currently sessions are roughly 10 mins long it seems and that’s a deal breaker…