Difference Between Properties of event.session in an Auth0 Post-Login Action

Auth0 post-login Actions offer the event and API objects for use. The event object contains specific details regarding the session object. This article defines the differences between the authenticated_at, created_at, last_interacted_at, and updated_at properties of the event.session object and provides a code snippet to determine if a session is new or reused.

• Auth0
• Actions
• Event Objects
• Post-Login Actions

What are the differences between the event.session properties?

Review the following list to understand the definitions and differences of each event.session property.

• event.session.authenticated_at: The last time the user authenticated with the session.
• event.session.created_at: When the session establishes, indicating when the user first authenticated.
• event.session.last_interacted_at: The last successful user interaction with the session, such as a silent authentication.
• event.session.updated_at: The last interaction of any kind within the session, including failed interactions.

NOTE: The authenticated_at and created_at properties typically match because the session establishes exactly after the first user authentication, but authenticated_at can differ later on. While last_interacted_at and updated_at might occasionally align, Auth0 updates updated_at for any interaction, including failures.

Implement a JavaScript code snippet to determine the session status.

Implement the following JavaScript code snippet within an Auth0 Post-Login Action to see whether the session appears newly created or if Auth0 reuses an existing session, allowing for conditional logic integration based on the console outputs.

exports.onExecutePostLogin = async (event, api) => {
  const createdAt = event.session?.created_at;
  const lastInteractedAt = event.session?.last_interacted_at;

  console.log(`event.session.created_at: ${createdAt}`);
  console.log(`event.session.last_interacted_at: ${lastInteractedAt}`);

  if (!event.session?.last_interacted_at) {
    console.log("last_interacted_at is missing, cannot reliably determine new session via comparison.");
  } else if (new Date(createdAt).getTime() === new Date(lastInteractedAt).getTime() || Math.abs(new Date(createdAt).getTime() - new Date(lastInteractedAt).getTime()) < 1000) {
    console.log("Session might have just been created.");
  } else {
    console.log("Existing session reused.");
  }
};