Reading through the Zero docs on authentication, I saw that JWT authentication was all that was supported (for now). I'm building a project using Ruby on Rails as an API and Next.js for the UI. While JWT auth is possible with Rails, most auth implementations are session based, included the built in auth solution to the latest Rails 8 release. Thus I wanted to figure out how to best set up Zero while still using the built in session based auth.
In this reply @aa, outlined how the Zero constructor can take a function for the auth
param https://bsky.app/profile/aaronboodman.com/post/3ldyz5bet3s2s
This all sounds right. The
auth
param to Zero's constructor can be a function. When the token expires, Zero invokes the function to get a new token. It's async so you can call an endpoint or whatever.
and later
To clarify further:
- keep the refresh token in an http-only cookie