How does Next-auth store session?

Question

I have a Next.js project with next-auth hooked up. But I'm confused on how next-auth store sessions.

On my Chrome cookie, I found this session-token: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..3_1xKir8Uf2dwky2._druNa1meJemDgeeYw5o6S840s_sW4DShuEu1w34RVAe8cyHm8-ryK5smM1ecKo1KZ_2faPUNpQTwMEUr-AW0Lo_0Oei_n9VIu7xTSET6W0ANdrL2Xg9ZUG9EziZYaW0VFEu.nPkQMkGcrvFRN5BIVvG_ng, but its payload is empty.

So my question is:

1. How is sessionId stored on the client side?
2. Does it store only the sessionId or full session data?
3. If it only stores the sessionId on client side, then does server-side manages session sharing on multi instances like serverless by default? I'm going to deploy it on Vercel.

Deena

When not using a database, next-auth stores the JWT session token in a server-readable-only cookie. See the "What are the advantages of JSON Web Tokens?" section in next-auth.js.org/faq. – Petterson

@Petterson in this case, I believe it stores full session data in the JWT token? then how come my JWT token's payload is empty ? – Deena

I'm asking myself the same question @Mars. Did you ever find an answer? – Infantile

@Infantile nope. my understanding is you either store all session data in token or some single instance thing on server side. – Deena

Answer 1

If we check the next auth documentation, we find that the token is only used for validation in the request that returns the user, see:

https://next-auth.js.org/getting-started/client#getsession

Ru