important
This is a contributors guide and NOT a user guide. Please visit these docs if you are using or evaluating SuperTokens.
Pre built UIDelete tokens of unused token transfer methods during createNewSession
Status
This is just a proposal so far, it hasn't been accepted and needs further discussion.
- Status:
- proposed
- Deciders:
- rishabhpoddar, porcellus
- Proposed by:
- porcellus
- Created:
- 2022-11-24
Context and Problem Statement#
In some cases, createNewSession can be called while there is an active session. Normally this would overwrite the old session, but there could be tokens present in other token transfer methods. E.g.:
- The request has an access token attached as header
- createNewSession is called
- getTokenTransferMethod returns cookies (for example because of a user override)
- We would are overwriting cookies, but that leaves tokens in storage associated with headers
Considered Options#
- Do not clear
- Clear other token transfer methods - if they have attached anything to the request (even invalid or expired tokens)
Decision Outcome#
Clear other token transfer methods. Reasons:
- We only want the tokens of a single session present in the browser.
- It avoids future issues/confusion by proactively cleaning up and not depending on future refresh calls.
- We will only clear headers/cookies if they were sent to us, avoiding sending the FE unexpected headers.