Nextjs-auth0: Verify email flow

[lkbr]

Thank you for this package, it's really simplified how I use Next.js and Auth0. I'm using it in conjunction with your example in the Next.js repo.

One thing I am struggling with is how to manage the email verification flow.

1. User signs up
2. We check for user.email_verified and ask them to verify their email if its false
3. User verify's email and returns to our app
4. At this point user.email_verified is still false and stale for the session

Is there a way to force a refetch of the user data without forcing the user to logout and login again?

[nabeards]

Has anyone found a way to make this work? The only way that user profile will get updated is if I logout and login again.

[nodabladam]

In our private route HOC that all our pages are wrapped with (example), we are checking the status and updating like this:

static async getInitialProps(ctx: any): Promise<any> {

  const user = getUserFromBackend();

  // only on SSR hit (like when someone clicks verify email link) rather than every page transition
  if (ctx.req) {

          // Confirm/Update email verification status
          if (user?.emailVerified === false) {
            // next.js auth0 getSession says email_verified false after the verify email link clicked
            // The problem seems to be that getSession is only "eventually consistent"
            // https://community.auth0.com/t/delay-after-email-verification/23437
            // workaround: immediately consistent https://auth0.com/docs/users/search/v3/get-users-by-id-endpoint
            const userAuth0ProfileQuery = await apolloClient.query({
              query: USER_AUTH0_PROFILE
            });

            const auth0EmailVerified = userAuth0ProfileQuery.data.userAuth0Profile.email_verified;
            if (auth0EmailVerified) {
              await backendUserService.updateUserEmailVerified();
            }
         } 
          ...
    }

[adamjmcgrath]

Hi @lkbr - thanks for raising this issue

We currently are looking into this use case for the Beta, will let you know what we come up with as a suggestion

[adamjmcgrath]

Hi @lkbr - there are 2 ways to update the session based on new info from Auth0 (eg the email_verified claim)

1. login again - if the user is already logged in and has a session on auth0.com, you can do this non-interactively using prompt=none, eg

await handleLogin(req, res, {
  authorizationParams: {
    prompt: 'none'
  }
});

See: https://auth0.com/docs/authorization/configure-silent-authentication

1. refetch the profile request a new set of claims from the /userinfo endpoint and update the session, eg

await handleProfile(req, res, {
  refetch: true
});

As for when to do one of these actions, that is trickier - there is no event from auth0.com that tells you when a user's email_verified claim has been updated.

You'd need to prompt the user to verify their email then perform an action that triggers one of the action's above until their email_verified claim is true

Or use a solution similar to https://github.com/auth0/nextjs-auth0/issues/23#issuecomment-690597702

Closing this for now, ping me if you'd like me to reopen it for more discussion