v4.0.0-beta.12: Unknown or invalid refresh token thrown from middleware

[chris-erickson]

Checklist

• The issue can be reproduced in the nextjs-auth0 sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

I followed the middleware setup instructions. If I leave a web app running overnight with inactivity, routes start triggering this error in the middleware.

Reproduction

ResponseBodyError: server responded with an error in the response body
    at async middleware (middleware.ts:8:18)
   6 |
   7 | export async function middleware(request: NextRequest) {
>  8 |   const authRes = await auth0.middleware(request);
     |                  ^
   9 |
  10 |   // authentication routes — let the middleware handle it
  11 |   if (request.nextUrl.pathname.startsWith("/auth")) { {
  code: 'OAUTH_RESPONSE_BODY_ERROR',
  error: 'invalid_grant',
  status: 403,
  error_description: 'Unknown or invalid refresh token.'

Additional context

No response

nextjs-auth0 version

v4.0.0-beta.12

Next.js version

15.1.1

Node.js version

v20.17.0

[guabu]

Hey @chris-erickson 👋 Thanks for the feedback! We're addressing this as part of another set of fixes around fetching and refreshing access tokens (linked above).

We'll be moving away from automatically refreshing access tokens in the middleware so this should fix the issue you're reporting.

[guabu]

This should be fixed in the latest release (4.0.0-beta.13). We've moved the access token refresh handling from the middleware to the getAccessToken handler so you should no longer be running into this issue after upgrading. Thanks for reporting this!