Skip to content

fix: prevent middleware from killing sessions after ~5 minutes#57

Merged
darshgupta-wisdm merged 1 commit intomainfrom
fix/session-expiry-middleware
Apr 16, 2026
Merged

fix: prevent middleware from killing sessions after ~5 minutes#57
darshgupta-wisdm merged 1 commit intomainfrom
fix/session-expiry-middleware

Conversation

@darshgupta-wisdm
Copy link
Copy Markdown
Collaborator

Summary

  • The JWT callback in authConfig dynamically imports Prisma to check for soft-deleted users and password changes
  • Middleware runs in Edge Runtime where Prisma's binary engine is unavailable — the import fails silently
  • After 5 consecutive failures, the token is wiped and the user is redirected to login
  • Fix: override the JWT callback in middleware to skip the DB check; the full check still runs in the Node.js auth instance on every server action

Test plan

  • Log in and browse the app for 5+ minutes without being logged out
  • Verify server actions (saving quotes, invoices) still work after extended browsing
  • Verify soft-deleted users are still blocked (via server-side auth, not middleware)

Fixes #54

🤖 Generated with Claude Code

The JWT callback in authConfig dynamically imports Prisma to check for
soft-deleted users and password changes. Middleware runs in Edge Runtime
where Prisma's binary engine is unavailable — the import fails silently,
and after 5 consecutive failures the token is wiped, forcing a redirect
to the login page.

Override the JWT callback in middleware to skip the DB check entirely.
Basic token fields (id, email, name) are still set. The full DB check
continues to run in the Node.js auth instance on every server action.

Fixes #54

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@darshgupta-wisdm darshgupta-wisdm merged commit ec46281 into main Apr 16, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: Sessions expire after ~5 minutes of browsing

1 participant