Alternative JWT auth mechanism? about nextjs-starter HOT 2 CLOSED

Pull requests with JWT sessions would be great. I appreciate it's a lot of work so seems unlikely, but even if it's only a partial implementation it would be something.

from nextjs-starter.

While appealing I think there are too many problems using only JWT tokens in practice, especially with oAuth.

For example because it doesn't store the RefreshToken server side, if the resets their local data or uses another browser or computer, then you can't get an updated AccessToken later if you want to make API calls - as APIs like Google+ only return a RefreshToken the first time a user signs in to a new service.

Storing things entirely client side in a JWT token (that is encrypted/decrypted on the server) is okay for some uses cases, but it's very limiting for many scenarios so I'm not going to worry about it now I have published the code for session management in next-auth and next-auth-client.

There is a case for using JWT tokens instead of having a session database (but still having a user database), but that's a slightly more specific use case that has some pitfalls of it's own - and the overhead of having a session database is low in most scenarios (especially as, in this example, it can just be a collection in the same database as the user data).

I'm going to close this issue. If it reopens at all it will probably be an enhancement to next-auth.

from nextjs-starter.