Skip to content

fix: Fix Session.refresh() KeyError by sealing session client-side #673

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gjtorikian merged 7 commits into from
Jun 18, 2026
+529 −43
Merged

fix: Fix Session.refresh() KeyError by sealing session client-side #673

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
5baf396
Fix Session.refresh() KeyError by sealing session client-side
devin-ai-integration[bot] Jun 17, 2026
962559c
Harden refresh() against malformed responses and add error-path tests
devin-ai-integration[bot] Jun 18, 2026
c8b5848
Guard decoded['sid'] with .get() and add async error-path tests
devin-ai-integration[bot] Jun 18, 2026
a5d573f
Defer state commit until after JWT validation
devin-ai-integration[bot] Jun 18, 2026
d2dca32
Map JWT decode errors to INVALID_JWT and unify user default
devin-ai-integration[bot] Jun 18, 2026
fd9cb56
Fix missing-sid test keypair and add async JWT error-path tests
devin-ai-integration[bot] Jun 18, 2026
4ee0cd9
Catch PyJWKClientError alongside InvalidTokenError in refresh
devin-ai-integration[bot] Jun 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
141 changes: 98 additions & 43 deletions src/workos/session.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,18 +336,11 @@ def refresh(
)

try:
# Use raw dict request because the generated AuthenticateResponse
# doesn't include sealed_session, and the request body needs the
# session parameter which isn't in the generated request models.
body: Dict[str, Any] = {
"grant_type": "refresh_token",
"client_id": self._client.client_id,
"client_secret": self._client._api_key,
"refresh_token": session["refresh_token"],
"session": {
"seal_session": True,
"cookie_password": effective_cookie_password,
},
}
if organization_id is not None:
body["organization_id"] = organization_id
Expand All @@ -358,31 +351,64 @@ def refresh(
body=body,
)

self.session_data = str(auth_response["sealed_session"])
self.cookie_password = effective_cookie_password

signing_key = self.jwks.get_signing_key_from_jwt(
auth_response["access_token"]
)
decoded = jwt.decode(
auth_response["access_token"],
signing_key.key,
algorithms=self._JWK_ALGORITHMS,
options={"verify_aud": False},
leeway=self._client._jwt_leeway,
access_token = auth_response.get("access_token")
refresh_token = auth_response.get("refresh_token")
if not access_token or not refresh_token:
return RefreshWithSessionCookieErrorResponse(
authenticated=False,
reason=AuthenticateWithSessionCookieFailureReason.REFRESH_DENIED,
)

user = auth_response.get("user") or {}
impersonator = auth_response.get("impersonator")

try:
signing_key = self.jwks.get_signing_key_from_jwt(access_token)
Comment thread
greptile-apps[bot] marked this conversation as resolved.
decoded = jwt.decode(
access_token,
signing_key.key,
algorithms=self._JWK_ALGORITHMS,
options={"verify_aud": False},
leeway=self._client._jwt_leeway,
)
except (
jwt.exceptions.InvalidTokenError,
jwt.exceptions.PyJWKClientError,
):
return RefreshWithSessionCookieErrorResponse(
authenticated=False,
reason=AuthenticateWithSessionCookieFailureReason.INVALID_JWT,
)

session_id = decoded.get("sid")
if not session_id:
return RefreshWithSessionCookieErrorResponse(
authenticated=False,
reason=AuthenticateWithSessionCookieFailureReason.INVALID_JWT,
)

new_sealed = seal_session_from_auth_response(
access_token=access_token,
refresh_token=refresh_token,
user=user,
impersonator=impersonator,
cookie_password=effective_cookie_password,
)

self.session_data = new_sealed
self.cookie_password = effective_cookie_password

return RefreshWithSessionCookieSuccessResponse(
authenticated=True,
sealed_session=str(auth_response["sealed_session"]),
session_id=decoded["sid"],
sealed_session=new_sealed,
session_id=session_id,
organization_id=decoded.get("org_id"),
role=decoded.get("role"),
roles=decoded.get("roles"),
permissions=decoded.get("permissions"),
entitlements=decoded.get("entitlements"),
user=auth_response.get("user"),
impersonator=auth_response.get("impersonator"),
user=user,
impersonator=impersonator,
feature_flags=decoded.get("feature_flags"),
)
except Exception as e:
Expand Down Expand Up @@ -523,10 +549,6 @@ async def refresh(
"client_id": self._client.client_id,
"client_secret": self._client._api_key,
"refresh_token": session["refresh_token"],
"session": {
"seal_session": True,
"cookie_password": effective_cookie_password,
},
}
if organization_id is not None:
body["organization_id"] = organization_id
Expand All @@ -537,31 +559,64 @@ async def refresh(
body=body,
)

self.session_data = str(auth_response["sealed_session"])
self.cookie_password = effective_cookie_password

signing_key = self.jwks.get_signing_key_from_jwt(
auth_response["access_token"]
)
decoded = jwt.decode(
auth_response["access_token"],
signing_key.key,
algorithms=self._JWK_ALGORITHMS,
options={"verify_aud": False},
leeway=self._client._jwt_leeway,
access_token = auth_response.get("access_token")
refresh_token = auth_response.get("refresh_token")
if not access_token or not refresh_token:
return RefreshWithSessionCookieErrorResponse(
authenticated=False,
reason=AuthenticateWithSessionCookieFailureReason.REFRESH_DENIED,
)

user = auth_response.get("user") or {}
impersonator = auth_response.get("impersonator")

try:
signing_key = self.jwks.get_signing_key_from_jwt(access_token)
decoded = jwt.decode(
access_token,
signing_key.key,
algorithms=self._JWK_ALGORITHMS,
options={"verify_aud": False},
leeway=self._client._jwt_leeway,
)
except (
jwt.exceptions.InvalidTokenError,
jwt.exceptions.PyJWKClientError,
):
return RefreshWithSessionCookieErrorResponse(
authenticated=False,
reason=AuthenticateWithSessionCookieFailureReason.INVALID_JWT,
)

session_id = decoded.get("sid")
if not session_id:
return RefreshWithSessionCookieErrorResponse(
authenticated=False,
reason=AuthenticateWithSessionCookieFailureReason.INVALID_JWT,
)

new_sealed = seal_session_from_auth_response(
access_token=access_token,
refresh_token=refresh_token,
user=user,
impersonator=impersonator,
cookie_password=effective_cookie_password,
)

self.session_data = new_sealed
self.cookie_password = effective_cookie_password

return RefreshWithSessionCookieSuccessResponse(
authenticated=True,
sealed_session=str(auth_response["sealed_session"]),
session_id=decoded["sid"],
sealed_session=new_sealed,
session_id=session_id,
organization_id=decoded.get("org_id"),
role=decoded.get("role"),
roles=decoded.get("roles"),
permissions=decoded.get("permissions"),
entitlements=decoded.get("entitlements"),
user=auth_response.get("user"),
impersonator=auth_response.get("impersonator"),
user=user,
impersonator=impersonator,
feature_flags=decoded.get("feature_flags"),
)
except Exception as e:
Expand Down
Loading