3 ms·

I feel you there - I do always feel like I'm writing a lot of code for something that should be better abstracted away - if I send a u/n and p/w once, then I sh

I feel you there - I do always feel like I'm writing a lot of code for something that should be better abstracted away - if I send a u/n and p/w once, then I should be logged in until I log out (or my session is invalidated server-side), and I'm always worried that that doesn't happen properly when I use the SDK. I THINK it does, but I got burned once when it broke last year around the 9.0.0 update, and now I struggle to trust it... I tend to end up doing something like this: https://github.com/directus/directus/discussions/10101 https://github.com/directus/directus/discussions/10101

likortera 4y ago
Yeah, that's the point. I think the SDK is not that helpful when running code in the backend (SSR). What frustrates me is that I don't get what's wrong with just using the traditional http-only secure cookie backed by a server side session. That just works, and it's one of the most safe ways to do it. Even banks do it that way. All the JWT temporary refresh token whatever sounds like somebody was just bored and wanted to have fun. Sorry, I was pretty burned out about this. So much that we ended up swapping it for something else.