Open
Description
Summary
There have been a couple people who have had their production app leak sessions due to misconfiguration of their middleware. We should add next-auth to our E2E suite as a standard/template so users don't accidentally make this crucial mistake.
Tasks
- Add
next-authtoE2Eapp - Generate JWT for test users
- Add test case to log in and out
- Add test case with 2 users to verify that session is not leaked
- Update docs with link to example and WARN users not to cache their SSR
Playwright cookies - injecting the mock JWT token to the test context:
export async function addCookies(context: any, token: Object) {
const e = await encode({
token,
secret: process.env.NEXTAUTH_SECRET!,
})
await context.addCookies([
{
name: `authjs.session-token`,
value: e,
url: 'http://localhost:3000',
},
])
}