Skip to main content

important

This is a contributors guide and NOT a user guide. Please visit these docs if you are using or evaluating SuperTokens.

Treat Authorization header as empty if it doesn't contain a SuperTokens token

Status

This is just a proposal so far, it hasn't been accepted and needs further discussion.

Status:: proposed
Deciders:: rishabhpoddar, porcellus
Proposed by:: porcellus
Created:: 2022-10-25

Context and Problem Statement#

People could try and call an API protected by verifySession with an access token from another provider (e.g.: during migration)

Considered Options#

Keep try refresh token
Return UNAUTHORISED without clearing cookies
Handle it as if it was not sent

Decision Outcome#

Handle it as if it was not sent, because:

Devs could try to attach an Authorization header meant for a different middleware - we can just use our own cookies if they exist
This is the way we handled things before adding header based auth - this way it can keep working the same for people who don't opt into using headers

This means:

We fall back to cookies if we detect the Authorization header contains anything that is not our accesstoken
If cookies don't exist we return TRY_REFRESH_TOKEN
If cookies exist we go through the usual validation steps

Context and Problem Statement
Considered Options
Decision Outcome