My auth0.ts file
import { isPlatform } from ‘@/constants’;
import { platformApps } from ‘@/constants/enums/enums’;
import { Auth0Client } from ‘
/nextjs-auth0/server’;
import { NextResponse } from ‘next/server’;
export const getAuth0Client = (params?: any) => {
const auth0 = new Auth0Client({
enableAccessTokenEndpoint: false,
authorizationParameters: params
? params
: {
audience: process.env.AUTH0_AUDIENCE,
…(isPlatform && { connection: ‘XXXXXXX’ }),
},
onCallback: async (error, context, session) => {
let errorCause = error?.cause?.toString();
if (errorCause?.includes('OAuth2Error:')) {
errorCause = errorCause.replace('OAuth2Error:', '');
}
if (errorCause && errorCause.includes('verify your email')) {
//grab the email from error messages
const emailRegex = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
const email = errorCause.match(emailRegex)?.[0];
//if email exist append it to the url otherwise make it empty string
const absoluteURL = `${process.env.AUTH0_BASE_URL}/verify-email-url`;
return NextResponse.redirect(absoluteURL);
} else if (error) {
//if error in signinng, redirect to the error page
const getPlatformLink = () => {
if (process.env.NEXT_PUBLIC_PLATFORM === platformApps) {
return `${process.env.AUTH0_BASE_URL}/error-url`;
} else {
return `${process.env.AUTH0_BASE_URL}/?authError=${errorCause}`;
}
};
const absoluteURL = getLink();
return NextResponse.redirect(absoluteURL);
}
let redirectUrl = process.env.AUTH0_BASE_URL;
let returnToUrl = context?.returnTo === '/' ? null : context?.returnTo;
return NextResponse.redirect(`${returnToUrl || redirectUrl}`);
},
});
return auth0;
};
My middleware.ts file
// import { auth0 } from '@/lib/auth0';
import { NextRequest, NextResponse } from 'next/server';
import { revalidateMyOrders } from './network/serverApis/creditCard';
import { protectedPages } from './constants/routes';
import { platformApps } from './constants/enums/enums';
import { i18nRouter } from 'next-i18n-router';
import { i18nConfig } from './i18n/i18nConfig';
import { getAuth0Client } from './lib/auth0';
const protectedRoutes: string[] = [
...protectedPages.filter(value => value.protected).map(value => value.href)
];
export default async function middleware(req: NextRequest) {
const pathname = req.nextUrl.pathname;
const absoluteUrlHub = `${process.env.AUTH0_BASE_URL}/login-url`;
const absoluteURL =
process.env.NEXT_PUBLIC__APP === platformApps
? absoluteUrlHub
: `${process.env.AUTH0_BASE_URL}`;
if (pathname.startsWith('/auth')) {
let params;
if (pathname === '/auth/login') {
if (req.url.includes('sign-up-url')) {
params = {
audience: process.env.AUTH0_AUDIENCE,
screen_hint: 'signup',
};
} else if (req.url.includes('url-1')) {
params = {
audience: process.env.AUTH0_AUDIENCE,
};
}
}
const auth0 = getAuth0Client(params);
return await auth0.middleware(req);
}
const responsei18nMiddleware = i18nRouter(req, i18nConfig);
if (pathname === '/url-2' || pathname === '/url-3') {
const auth0 = getAuth0Client();
// get the user
const getUserSession = await auth0.getSession();
// if the user exist redirect to homepage
if (getUserSession) return NextResponse.redirect(absoluteURL.toString());
}
if (protectedRoutes.includes(pathname) || pathname.includes('/my-url')) {
const auth0 = getAuth0Client();
try {
// get the user
const getUserSession = await auth0.getSession();
if (getUserSession) {
let timeNow = Math.floor(Date.now() / 1000);
// Note the difference is in seconds
let diff = getUserSession.tokenSet.expiresAt - timeNow;
if (diff <= Number(process.env.MIDDLEWARE_REFRESH_TOKEN_THRESHOLD || 300)) {
// refreshing the token because in server components the token is not updated
await auth0.getAccessToken(req, responsei18nMiddleware, {
refresh: true,
});
}
}
// if the user does not exist redirect to unauthorized
if (getUserSession === null) {
return NextResponse.redirect(absoluteURL.toString());
}
} catch (error) {
console.log('error getting user session: ', error);
}
}
return responsei18nMiddleware;
}
export const config = {
matcher: '/((?!api|static|.*\\..*|_next).*)',
};
I have been encountering issues that my application is using the same refresh token twice which invalidates the session and forces the user to logout. I haven’t able to produce the error but I still see it in logs.
I am using these packages:
auth0 sdk: “@auth0/nextjs-auth0”: “4.6.1”
NextJS version: 15.0.4
Any ideas from anyone?