Updated
Should I set a shorter Max-Age parameter on the cookies?
The Max-Age or Expires cookie parameters only control whether the browser sends the value to the server. Since a refresh token represents the long-lived authentication session of the user on that browser, setting a short Max-Age or Expires parameter on the cookies only results in a degraded user experience.
The only way to ensure that a user has logged out or their session has ended is to get the user’s details with getUser(). The getClaims() method only checks local JWT validation (signature and expiration), but it doesn’t verify with the auth server whether the session is still valid or if the user has logged out server-side.
Related topics
- Server-side rendering with Auth
- JWTs
- How do I make the cookies HttpOnly?
- How do you troubleshoot Next.js and Supabase Auth issues?
- Fetch requests to API endpoints aren’t showing the session