Calling getToken after getServerSession might miss a token change

[NaraJeamfry]

Environment

---

• Operating System: Linux
• Node Version: v20.19.1
• Nuxt Version: 3.17.5
• CLI Version: 3.25.1
• Nitro Version: 2.11.12
• Package Manager: npm@10.8.2
• Builder: -
• User Config: compatibilityDate, devtools, modules, auth
• Runtime Modules: @sidebase/nuxt-auth@0.10.1
• Build Modules: -

---

Reproduction

I have managed to reproduce the issue in a pretty minimal StackBlitz. As it requires having authenticated and StackBlitz is a bit finicky with the baseURL, you may need to change that value to your web container. Most possibly my lack of experience with StackBlitz.

https://stackblitz.com/edit/github-ssrhifee?file=app.vue,nuxt.config.ts,server%2Fapi%2Fauth%2F[...].js,server%2Fapi%2Ftest.js

Describe the bug

If you call to getServerSession and getToken in a server-side function, any modifications made to the token by the session call (which includes the jwt and session callbacks) will not be updated. The token received will always be the original one from the client request.

Additional context

The issue is caused by the resolution of issue #523, which consisted of using a virtual request for getServerSession to avoid mutations to the original request. Even though I agree that limiting modifications to the request is a must-have, doing it this way causes an issue with the token.

Because the AuthHandler expects the call to session to be made directly by the client, it will send updates to the token via Set-Cookie. Because we are using a virtual request, this update to the token is totally lost. This means that, if you use getToken inside a Server function after a getServerSession call, the token may have changes that you cannot recover and getToken will return an outdated token.

I don't really have that much experience with TS so I'm not really sure if I should try to submit a PR. Open to suggestions though!

Logs

[phoenix-ru]

Thanks for a good write up! As you correctly noticed, original event not being modified is intentional. At the moment we only return the body of the session and not other data (cookies, redirect, etc.):

nuxt-auth/src/runtime/server/services/authjs/nuxtAuthHandler.ts

Lines 143 to 144 in 58193dd

	// Get the body of response
	const session = authjsResponse.body

It's easy to add though. You can rename getServerSession to getServerSessionRaw and return authjsResponse directly:

nuxt-auth/src/runtime/server/services/authjs/nuxtAuthHandler.ts

Line 106 in 58193dd

export async function getServerSession(event: H3Event) {

nuxt-auth/src/runtime/server/services/authjs/nuxtAuthHandler.ts

Line 141 in 58193dd

const authjsResponse = await preparedAuthjsHandler(authjsRequest)

Then re-add getServerSession which would call getServerSessionRaw and return body as it is now:

nuxt-auth/src/runtime/server/services/authjs/nuxtAuthHandler.ts

Lines 145 to 149 in 58193dd

	if (isNonEmptyObject(session)) {
	return session as Session
	}
	return null

Would you be up to open such a PR? Otherwise we can tackle it (but with a low prio)

[NaraJeamfry]

Hi! Sorry for the long silence!

I think I can try to tackle this soon. I'm thinking on multiple options aside from just adding the old method as an alternative, but they have some drawbacks, so ideally, I would like to double-check with you if possible.

• I can just add a getServerSessionRaw as already pointed out; this just enables my previous workaround and doesn't fix the (for me) underlying issue (calling getToken after getServerSession returns the original token even though it has been updated by the NextAuth handler call).
• I can add logic to store the updated token in the NuxtAuthHandler after a getServerSession and return the updated token (if stored) in getToken. Should fix the issue transparently but, as I see it, it could cause errors for developers that depend on that issue. Also, I'm not 100% it wouldn't get messy in servers (maybe the token could get leaked, or similar issues could happen? I don't know enough about h3 and Node to say).
• Find out some way to store the updated token in the H3Event that's being sent around without it being sent as headers or cookies later. This solves any leaks or similar issues afaik, but wouldn't be so transparent and can (will) probably have side effects for users that expect the H3Event to be totally unchanged. Maybe there's a way in TS/JS to add a private property to the object or something like that?

Towards the end of the week I'll try to get some time to at least test the getServerSessionRaw option, but if someone wants to chime in and suggest anything, it'll be great. Thanks!