Can i create a session from api route?

[niklasgrewe]

I have a custom api route, to validate a token. I want to create a new user session from this api endpoint. How can i do that? At the moment, my api route looks something like this:

const validateTokenHandler = async (req: BlitzApiRequest, res: BlitzApiResponse) => {
  if (!req.headers.authorization) return res.status(400).send("")

  try {
    // validate token
    const user = await db.user.findFirst({ where: { email } })
    if (!user) {
      res.redirect("/onboarding")
    } else if (user.username) {
      const user = await invokeWithMiddleware(login, { email: email }, { req, res })
      res.redirect(`/${user.memberships[0].team.slug}`)
    }
  } catch (error) {
    console.log(error.message)
    res.status(500).json({ error: error.message })
  }
}
export default validateTokenHandler

The route works. A new session will be created and the user will be redirected to there page. But on the server console, i get a CSRFTokenMismatchError, although I send the CSRF token with it. Where is my mistake? How can i solve this?

[flybayer]

Hey @niklasgrewe sorry for the delay, I've been on vacation.

Are you still having this problem?

Also where does email variable come from?

[Jonovono]

I am wondering about this too @flybayer @niklasgrewe. How would you go about it?

[MrLeebo]

Can you provide more information for why you would do that? Generally token based auth strategies (server-to-server communication) doesn't involve session cookies, the client would make each request using the same token.

[Jonovono]

I figured it out, thanks. Basically, what I was doing is I had an API call from a redirect handler for a 3rd party auth service, that I wanted to create a session when it was hit.

Was able to just do:

    const session = await getSession(req, res)
    await signup({ email, password: access_token }, session)