# How do we ensure a session is still valid on refresh with NextJS app folder?

**URL:** <https://community.auth0.com/t/how-do-we-ensure-a-session-is-still-valid-on-refresh-with-nextjs-app-folder/113616>\
**Category:** Get Help\
**Tags:** sessions, logout\
**Created:** [August 14, 2023, 9:40pm UTC](https://community.auth0.com/t/how-do-we-ensure-a-session-is-still-valid-on-refresh-with-nextjs-app-folder/113616 "2023-08-14T21:40:52Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![bradleygriffith-cit](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@bradleygriffith-cit](https://community.auth0.com/u/bradleygriffith-cit)\
**Post date:** [August 14, 2023, 9:40pm UTC](https://community.auth0.com/t/how-do-we-ensure-a-session-is-still-valid-on-refresh-with-nextjs-app-folder/113616/1 "2023-08-14T21:40:52Z")

</div>

My team is using the `@auth0/nextjs-auth0` SDK, version `3.1.0`.

Our codebase uses the NextJS `app` directory structure, and I have followed along with the `README`, documentation, and [example app](https://developer.auth0.com/resources/code-samples/web-app/nextjs/basic-authentication) closely.

Logging in and logging out works fine. However, I have noticed that no matter what I set our Refresh Token settings (e.g.; their timeouts) nor our Identity Token settings to, I am unable to force my user to re-sign in after these tokens expire. The app seems to simply always allow refreshing the app and still having he user appear to be logged in, even as far as `useUser` continuing to work.

This gets worse because it appears that I can even delete the user in Auth0’s admin panel and they are _still_ able to stay signed in, refresh the browser, and fetch some features such as via `useUser`.

This is _not_ appearing true for the access token or identity token. On the server-side (of NextJS, in the `app/api` handlers), `getAccessToken` and `getSession` appear to always return a value, but our actual backend is refusing the tokens. So it appears there is a discrepancy happening here.

How do I make my NextJS 13 `app` router based Auth0 app always attempt to re-authenticate the user during a page load or refresh so that even if they had previously signed on and a session token was stored by Auth0, that there is still a real round trip to confirm that the session _should_ be valid (that the user exists or that they didnt change their password).

Ill paste some code here to illustrate our app setup thus far:

`middleware.js`

```auto
import { withMiddlewareAuthRequired } from "@auth0/nextjs-auth0/edge";

// The following paths will require authentication.
// Note that root, `/`, is not included but will ultimately also required
// authentication, due to a next.js config setting that redirects `/` to
// `/incidents`.
// See: https://auth0.github.io/nextjs-auth0/types/helpers_with_middleware_auth_required.WithMiddlewareAuthRequired.html
export const config = {
  matcher: [
    "/incidents/:path*",
    "/settings/:path*"
  ],
};

export default withMiddlewareAuthRequired();

```

`app/api/auth/[auth0.js]`

```auto
import { handleAuth, handleLogin, handleLogout } from "@auth0/nextjs-auth0";

export const GET = handleAuth({
  login: handleLogin({
    authorizationParams: {
      prompt: "login",
    },
    returnTo: "/incidents",
  }),
  logout: handleLogout(() => {
    return {
      returnTo: "/",
    };
  }),
  onError(req, error) {
    console.error("An Auth0 error occured:", error);
  }
});

```

---

<div class="post-metadata">

**Author:** ![christian.aquino](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/christian.aquino/32/39805_2.png) [@christian.aquino](https://community.auth0.com/u/christian.aquino)\
**Post date:** [September 8, 2023, 8:05pm UTC](https://community.auth0.com/t/how-do-we-ensure-a-session-is-still-valid-on-refresh-with-nextjs-app-folder/113616/2 "2023-09-08T20:05:18Z")

</div>

Hi @bradleygriffith-cit! Have you solve that? I have the same problem.

---

<div class="post-metadata">

**Author:** ![drustill4](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/drustill4/32/48681_2.png) [@drustill4](https://community.auth0.com/u/drustill4)\
**Post date:** [February 4, 2024, 6:39pm UTC](https://community.auth0.com/t/how-do-we-ensure-a-session-is-still-valid-on-refresh-with-nextjs-app-folder/113616/3 "2024-02-04T18:39:19Z")

</div>

Hey @bradleygriffith-cit , also have been running into this issue on and off for months now. Wondering if you ever came around to figuring this out?

---

<div class="post-metadata">

**Author:** ![lucas8](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lucas8/32/49896_2.png) [@lucas8](https://community.auth0.com/u/lucas8)\
**Post date:** [April 4, 2024, 4:01pm UTC](https://community.auth0.com/t/how-do-we-ensure-a-session-is-still-valid-on-refresh-with-nextjs-app-folder/113616/4 "2024-04-04T16:01:39Z")

</div>

Getting the same issue. I also find that logout from a user (cookie is deleted) but then redirect is done the cookie is appended with the previous user. Even if a log in to another user, it only update client side (useUser), if I reload the app it will come back to previous logged in user since the appSession in cookie belongs to it

---

<div class="post-metadata">

**Author:** ![BohdanYavorskyi](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/bohdanyavorskyi/32/60840_2.png) [@BohdanYavorskyi](https://community.auth0.com/u/BohdanYavorskyi)\
**Post date:** [September 26, 2024, 12:39am UTC](https://community.auth0.com/t/how-do-we-ensure-a-session-is-still-valid-on-refresh-with-nextjs-app-folder/113616/5 "2024-09-26T00:39:49Z")

</div>

Same here… @lucas8 @drustill4 @bradleygriffith-cit @christian.aquino have you solved this issue?

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [February 18, 2025, 7:56pm UTC](https://community.auth0.com/t/how-do-we-ensure-a-session-is-still-valid-on-refresh-with-nextjs-app-folder/113616/6 "2025-02-18T19:56:06Z")

</div>

Hi everyone and @bradleygriffith-cit

Thank you for posting your questions on the community!

I am sorry about the late reply to your post.

For the issue you are experiencing, I would advise to check the session of the user whenever they access the webpage and redirect them to the `logout` endpoint since your application does not seem to handle that.

I would recommend to review this [community post](https://community.auth0.com/t/getsession-unable-to-authenticate-user-in-nextjs-server-side/121394), also [How to redirect user to login when token is expire](https://community.auth0.com/t/how-to-redirect-user-to-login-when-token-is-expire/119959) and this [knowledge article](https://community.auth0.com/t/sync-session-with-auth0-when-using-next-js/114256) regarding the matter.

If you have found a solution or have additional questions regarding the matter, feel free to leave a reply or post again on the community!

Kind Regards,  
Nik

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 4, 2025, 7:56pm UTC](https://community.auth0.com/t/how-do-we-ensure-a-session-is-still-valid-on-refresh-with-nextjs-app-folder/113616/8 "2025-03-04T19:56:35Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.