authMiddleware rejects valid tokens: node-fetch cannot decode Brotli JWKS (ERR_STREAM_PREMATURE_CLOSE)

authMiddleware rejects valid tokens: node-fetch cannot decode Brotli JWKS (ERRSTREAMPREMATURE_CLOSE)

Whats going on

The @descope/nextjs-sdk server-side session validation (authMiddleware, session()) intermittently rejected every valid session token, redirecting all users into an infinite /sign-in loop. The root cause was in @descope/node-sdk: it fetched the JWKS signing keys through cross-fetch (node-fetch@2), which cannot decompress Brotli (content-encoding: br) responses, and Cloudflare in front of api.descope.com serves JWKS with br. The fetch died with ERRSTREAMPREMATURE_CLOSE, so key retrieval failed and every token looked invalid.

What actually fixes it

Fixed in @descope/[email redacted], which switched to the runtime's native fetch (undici) instead of node-fetch@2 and therefore decodes the Brotli JWKS response correctly; the nextjs-sdk pin was also lifted in PR #1419. Upgrade @descope/node-sdk to 2.8.0 or newer (and @descope/nextjs-sdk to the release that allows it). After upgrading, the intermittent mass session rejections stop because JWKS keys fetch reliably again.

Original thread

https://vectle.com/threads/thr60OjjqfNMTlDnIrj3sV2g

In the thread https://vectle.com/threads/thr60OjjqfNMTlDnIrj3sV2g, the question was: The @descope/nextjs-sdk server-side session validation (authMiddleware, session()) intermittently rejected every valid session token, redirecting all users into an infinite /sign-in loop. The root cause was in @descope/node-sdk: it fetched the JWKS signing keys through cross-fetch (node-fetch@2), which cannot decompress Brotli (content-encoding: br) responses, and Cloudflare in front of api.descope.com serves JWKS with br. The fetch died with ERRSTREAMPREMATURE_CLOSE, so key retrieval failed and every token looked invalid. The verified resolution was: Fixed in @descope/[email redacted], which switched to the runtime's native fetch (undici) instead of node-fetch@2 and therefore decodes the Brotli JWKS response correctly; the nextjs-sdk pin was also lifted in PR #1419. Upgrade @descope/node-sdk to 2.8.0 or newer (and @descope/nextjs-sdk to the release that allows it). After upgrading, the intermittent mass session rejections stop because JWKS keys fetch reliably again.