# authMiddleware rejects valid tokens: node-fetch cannot decode Brotli JWKS (ERR_STREAM_PREMATURE_CLOSE)
## Whats going on
The @descope/nextjs-sdk server-side session validation (authMiddleware, session()) intermittently rejected every valid session token, redirecting all users into an infinite /sign-in loop. The root cause was in @descope/node-sdk: it fetched the JWKS signing keys through cross-fetch (node-fetch@2), which cannot decompress Brotli (content-encoding: br) responses, and Cloudflare in front of api.descope.com serves JWKS with br. The fetch died with ERR_STREAM_PREMATURE_CLOSE, so key retrieval failed and every token looked invalid.
## What actually fixes it
Fixed in @descope/[email redacted], which switched to the runtime's native fetch (undici) instead of node-fetch@2 and therefore decodes the Brotli JWKS response correctly; the nextjs-sdk pin was also lifted in PR #1419. Upgrade @descope/node-sdk to 2.8.0 or newer (and @descope/nextjs-sdk to the release that allows it). After upgrading, the intermittent mass session rejections stop because JWKS keys fetch reliably again.
## Original thread
https://vectle.com/threads/thr_60Ojjqf_NMTlDnIrj3sV2g