How can I extend session expiry?

[byte-my-briefs]

Brief Question

I would like to extend the session expiry ("exp"). Currently, it seems to be set to 60 seconds. For reasons explained at more length in the next section, I would like to extend it rather significantly.

The session docs claim that the "exp" field is "[d]etermined using the Token lifetime JWT template setting in the Clerk Dashboard.". However, I modified this up to 604,800 (1 week) to test it yesterday and it has had no effect.

Does anyone know how I can address this?

Detailed Summary of Issue

NOTE: The above is a workaround fix for the issue I am experiencing below. The below is more complex, and I welcome any advice that helps to address the issue more directly.

I have a (1) Webapp, and (2) a Chrome extension (primarily run as a "New Tab"), both coded in Sveltekit. I would like to share session state between the two. This works, so long as the webapp is open in a separate tab. However, after the webapp is closed, the session within the extension expires with 60 seconds. Though the frontend session is still recognize (and the <SignedIn /> component therefore still functions properly), the backend rejects all requests, claiming that the session token ahs expired.

I have tried adapting the @clerk/chrome-extension to work with SvelteKit, but it has resulted in no success. Additionally, it is worth noting that I have followed the steps outlined in the @clerk/chrome-extension README, including disabling URL-based session sharing in dev/staging and adding the extension to allowed_origins.

I am not sure if I am settings my settings wrong or otherwise handling the session-sharing wrong.

Please let me know if you have any advice, or if any more information would in evaluating the issue.

[aglontaru-sapiema]

Did you find any way of extending the "exp"? I also need to do this to allow my web app users to authenticate within a CLI.

[byte-my-briefs]

Not particularly. To fix my issue instead, I run the following function on an interval:

setTimeout(async () => {
        // Get a new, updated session cookie.
        const token = await clerk.session.getToken(...);

        // Update the cookie on my webapp for use by my extension.
        await chrome.cookies.set({
                httpOnly: false,
	        name: '__session',
	        path: '/',
	        secure: false,
	        url: import.meta.env.VITE_WEBAPP_URL,
	        value: token
        });
}, 30_000); // Run every 30s to ensure webapp cookie never goes stale

This exact approach will (of course) not work in a CLI because you do not have access to chrome API. However, perhaps there is a similar way you can use the Clerk client to fetch a new session token and manually update the cookie?

Happy to help brainstorm ideas and answer any questions, so please let me know!

[avemeva]

@ByteMyBriefs Hey! Can you please share a bit more on how to properly do that in Chrome Extension? For some reason my clerk.session is either null, or if I am using clerk.load() it complains about no document (seems like expected to be run in content script)

1. Is this script part of content script or background script? (background)
2. Can you show how you setup Clerk instance is that normal setup or with some things like in chrome-extension package?

I have exactly the same situation as you do. I have Clerk on my website, but need to keep JWT refreshed in my Chrome Extension to access backend api.

[avemeva]

Link on related discussion in Clerk discord

[jescalan]

https://github.com/orgs/clerk/discussions/3829

[thedogwiththedataonit]

I think I found the solution. The docs aren't too clear on this, but you have to create a JWT template to define a custom expiration. Once created, the getToken() function has a parameter called template which is where you put the name of the JWT template you created.

const token = await getToken({ template: "Admin", })

I just spent 2 hours trying to figure this out so I hope it helps someone.

[jescalan]

@shellscape - want to check in here quickly - would this backed api endpoint do the trick for you? it allows creation of a session token from the backend for testing purposes, and you can set a custom expiration.

[shellscape]

outstanding, thank you.

[jescalan]

Hooray! I will make sure this is documented more prominently. Let me ask here since you might have a good take - if you were going into our docs to look for something like this, what would you search for?

[T-P-F]

@jescalan I've been searching for exactly this so here are some searches I did (including the one that led me to this thread): "session-token-expired-refresh-non-eligible-non-get" "x-clerk-auth-reason" "clerk session expiration" "clerk token expiration" "clerk dev environment tokens" etc..

[jescalan]

Please reach out to Clerk support if you are having issues! We do not monitor or reply to github discussions.