bug: Logto getContext Fetches New Access Token on Every Request Instead of Using Session Storage

[AdzeB]

Describe the bug

I'm encountering an issue where calling getAccessToken seems to generate a new access token every time I make a request to a protected route.

Expected behavior

createCookieSessionStorage should persist the token and only refresh it when it expires.

How to reproduce?

1. Setup a Remix App with Logto
   Ensure you have Logto installed and configured correctly.

2. Define Session Storage and Logto Client

import { createCookieSessionStorage } from "@remix-run/node";
import { makeLogtoRemix } from "@logto/remix";
import { UserScope } from "@logto/client";

export const sessionStorage = createCookieSessionStorage({
  cookie: {
    name: "_authsession",
    sameSite: "lax",
    path: "/",
    httpOnly: true,
    secrets: ["s3ct"],
    secure: process.env.NODE_ENV === "production",
  },
});

export const logto = makeLogtoRemix(
  {
    endpoint: process.env.LOGTO_ENDPOINT || "",
    appId: process.env.LOGTO_APP_ID || "",
    appSecret: process.env.LOGTO_APP_SECRET || "",
    baseUrl: process.env.LOGTO_BASE_URL || "",
    resources: [process.env.LOGTO_RESOURCE_URI as string],
    scopes: [
      "openid",
      "email",
      "profile",
      UserScope.Roles,
      UserScope.CustomData,
      UserScope.Identities,
      UserScope.Phone,
      UserScope.Organizations,
    ],
  },
  { sessionStorage }
);

3. Create a Protected Route (routes/_main.tsx)

export const loader: LoaderFunction = async ({ request }) => {
  const context = await logto.getContext({
    getAccessToken: true,
    fetchUserInfo: true,
  })(request);

  console.log("Context:", context);

  if (!context.isAuthenticated) {
    return redirect("/api/logto/sign-out");
  }

  return json({ accessToken: context.accessToken });
};

Context

• Logto Cloud
• Self-hosted, Logto version =
• Container (Docker image)
• Raw Node.js

Screenshots

[wangsijie]

I’ve tested it and everything works as expected. The access token is cached locally. You can refer to this sample: #952

I am closing this now, feel free to reopen if you have any further questions.