Unable to update the session using newly minted JWT token

[anshul-kai]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Although the JWT secret is exposed via the dashboard, one is unable to make use of it to update the session using the supabase.auth.setSession function. It ignores the changes made to the newly created & signed tokens.

What is the purpose of exposing the JWT secret if user-created tokens are being ignored?

To Reproduce

  import { createServerClient } from '@supabase/ssr';
  import { headers, cookies } from 'next/headers';

  const supabase = createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
    {
      cookies: {
        getAll() {
          return cookieStore.getAll();
        },
        setAll(cookiesToSet) {
          try {
            cookiesToSet.forEach(({ name, value, options }) => {
              cookieStore.set(name, value, options);
            });
          } catch (error) {
          }
        }
      }
    }
  );

  const {
    data: { session }
  } = await supabase.auth.getSession();

  const decoded = jwt.verify(
    session.access_token,
    process.env.SUPABASE_JWT_SECRET!
  );

  // Update expiry to 1 minute from now
  const newTokenJson = { ...decoded, exp: Math.round(Date.now() / 1000 + 60) };
  const newToken = jwt.sign(newTokenJson, process.env.SUPABASE_JWT_SECRET!);

  // No error is returned and the data object reflects the new token but auth.sessions table is not updated. A call to auth.getSession() continues to return the old values.
  const { data, error } = await supabase.auth.setSession({
    access_token: newToken,
    refresh_token: 'abc'
  });

Expected behavior

Create APIs/functions to override default token functionality ie. set expiration and renewal rules

1. One should be able to update/override the expiration of the current JWT token
2. One should be able to disable or intercept the auto-refresh functionality

System information

• OS: macOS
• Platform: Next.js
• Browser: Chrome
• Version of supabase-js: 2.45.2
• Version of supabase-ssr: 0.5.1
• Version of Node.js: 20.12.2