Refresh token rotation using the JWT callback does not work in app directory

[PaulWild]

What is the improvement or update you wish to see?

The app directory feature of Next.js does not allow the cookies to be updated on the server. This means that any usages of getServerSession that would trigger a refresh token rotation as described in the docs would not set the new access token / refresh token / expires time in the next-auth cooke.

This should be made clear in the documentation.

Is there any context that might help us understand?

N/A

Does the docs page already exist? Please link to it.

https://authjs.dev/guides/basics/refresh-token-rotation

[AdisonCavani]

See: https://next-auth.js.org/configuration/nextjs#in-app-directory

Currently, the underlying Next.js cookies() method only provides read access to the request cookies. This means that the expires value is stripped away from session in Server Components. Furthermore, there is a hard expiry on sessions, after which the user will be required to sign in again. (The default expiry is 30 days).

Next.js docs: https://nextjs.org/docs/app/api-reference/functions/cookies
Next.js recently added API for cookies, but only for Server Action or Route Handler.

Similar issue: #7025

[balazsorban44]

Closing as mentioned above. We are working on support for this via other means (Server Action, Route Handler, and/or Middleware) in the next major version of NextAuth.js.

[PaulWild]

It's great to hear that this will be implemented, but as raised the documentation for the current version are not clear that the token refresh won't work as expected in the app directory. Is it not worth adding a small warning on the guide?

[balazsorban44]

It's already mentioned here: https://next-auth.js.org/configuration/nextjs#in-app-directory

The refresh token rotation guide purposefully does not mention App Router yet.