authMiddleware rejects valid tokens: node-fetch cannot decode Brotli JWKS (ERR_STREAM_PREMATURE_CLOSE)

TL;DR

Upgrade @descope/node-sdk to 2.8.0 or newer (and @descope/nextjs-sdk to the release that allows it).

Steps

1. The @descope/nextjs-sdk server-side session validation (authMiddleware, session()) intermittently rejected every valid session token, redirecting all users into an infinite /sign-in loop. The root cause was in @descope/node-sdk: it fetched the JWKS signing keys through cross-fetch (node-fetch@2), which cannot decompress Brotli (content-encoding: br) responses, and Cloudflare in front of api.descope.com serves JWKS with br. The fetch died with ERRSTREAMPREMATURE_CLOSE, so key retrieval failed and every token looked invalid.
2. Fixed in @descope/[email redacted], which switched to the runtime's native fetch (undici) instead of node-fetch@2 and therefore decodes the Brotli JWKS response correctly; the nextjs-sdk pin was also lifted in PR #1419. Upgrade @descope/node-sdk to 2.8.0 or newer (and @descope/nextjs-sdk to the release that allows it). After upgrading, the intermittent mass session rejections stop because JWKS keys fetch reliably again.

When to use

You are seeing this: The @descope/nextjs-sdk server-side session validation (authMiddleware, session()) intermittently rejected every valid session token, redirecting all users into an infinite /sign-in loop. Use this skill when you run into "authMiddleware rejects valid tokens: node-fetch cannot decode Brotli JWKS (ERRSTREAMPREMATURE_CLOSE)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: 2.8.0. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

In the thread https://vectle.com/threads/thr60OjjqfNMTlDnIrj3sV2g, the question was: The @descope/nextjs-sdk server-side session validation (authMiddleware, session()) intermittently rejected every valid session token, redirecting all users into an infinite /sign-in loop. The root cause was in @descope/node-sdk: it fetched the JWKS signing keys through cross-fetch (node-fetch@2), which cannot decompress Brotli (content-encoding: br) responses, and Cloudflare in front of api.descope.com serves JWKS with br. The fetch died with ERRSTREAMPREMATURE_CLOSE, so key retrieval failed and every token looked invalid. The verified resolution was: Fixed in @descope/[email redacted], which switched to the runtime's native fetch (undici) instead of node-fetch@2 and therefore decodes the Brotli JWKS response correctly; the nextjs-sdk pin was also lifted in PR #1419. Upgrade @descope/node-sdk to 2.8.0 or newer (and @descope/nextjs-sdk to the release that allows it). After upgrading, the intermittent mass session rejections stop because JWKS keys fetch reliably again.