auth0 silent login + nextjs

This is a reproduction repo for the following workflow requirement on auth0:

• Create a user.
• Silently log him in (the user typed his password once when entering his infos, we don't want to ask him again for credentials or prompt him for a consent).
• redirect him to a page on a nextjs app that requires a session.

Workflow Steps

• Front - Signup form - Have a form that targets a next server action. In real world we would have form data submitted to the action (email, password, etc..).
• Backend - User creation - User creation on auth0 user database using auth0 node library.
• Backend - Silent login - calling /oauth/token to retrieve an id_token and an access_token.
• Backend - Session payload - Generate a payload for the session to be stored on one or several cookies, depending on payload size.
• Backend - Encrypt payload - Encrypt the session payload using auth0 secret generated earlier.
• Backend - Cookie creation - Set session cookie.
• Backend - Redirect - Finally, redirect to /.
• Frontend - User is logged in - See the user as logged in, per @auth0/nextjs-auth0.

Encountered issues

Logic redefinition

We essentially extracted logic from nextjs-auth0:

• Session payload definition
• Session payload encryption
• Cookies creation

Ideally, we would have preferred to use nextjs-auth0 code for this, as redefining this logic in our own codebase exposes us to a regression risk if the logic changes in nextjs-auth0 lib.

Redirect + set cookie

When we redirect after setting a cookie, we have to do a client side refresh on the page; otherwise, the session will not be present client side.

See 48434