Single page application - check session offline

somekh.dave · February 28, 2020, 3:02pm

After a successful login on my SPA, I want to perform a session check each time a person navigates between pages. Can I do it without going to the server? I just want a simple check that is fast. As far as I understand, the isAuthenticated API call checks it online.

Thanks!
David

mathiasconradt · March 7, 2020, 6:19pm

Just to confirm, you mean the Auth0 session layer, right?
Referring to Sessions → Session Layers

isauthenticated as per
https://auth0.github.io/auth0-spa-js/classes/auth0client.html#isauthenticated

returns true if there’s valid information stored, otherwise returns false.

Looking at the source code:

github.com

auth0/auth0-spa-js/blob/fb984a6/src/Auth0Client.ts#L479


      
          
          /**
           * ```js
           * const isAuthenticated = await auth0.isAuthenticated();
           * ```
           *
           * Returns `true` if there's valid information stored,
           * otherwise returns `false`.
           *
           */
          public async isAuthenticated() {
            const user = await this.getUser();
            return !!user;
          }
          
          /**
           * ```js
           * auth0.logout();
           * ```
           *
           * Performs a redirect to `/v2/logout` using the parameters provided

it’s calling this.getUser()

github.com

auth0/auth0-spa-js/blob/fb984a6/src/Auth0Client.ts#L218


      
          /**
           * ```js
           * const user = await auth0.getUser();
           * ```
           *
           * Returns the user information if available (decoded
           * from the `id_token`).
           *
           * @param options
           */
          public async getUser(
            options: GetUserOptions = {
              audience: this.options.audience || 'default',
              scope: this.options.scope || this.DEFAULT_SCOPE
            }
          ) {
            options.scope = getUniqueScopes(this.DEFAULT_SCOPE, options.scope);
            const cache = this.cache.get(options);
            return cache && cache.decodedToken.user;
          }

which in turn checks if there’s valid information from the decoded ID Token in the cache.

So, no, it doesn’t check for a valid session. It checks for valid user information in the SPA SDK cache.

What’s your intention with this session check - what do you need this info for? If you want to check for a valid Auth0 session, you need to check against the Auth0 server (no way to check that offline), for which you can use the silent authentication approach.