title: Understanding Next.JS with-iron-sessions requirements for use in own environment
body: <p>I am trying to get some of the examples located in the with-ireon-sessions github account to work with my own back-end: <a href="https://github.com/vercel/next.js/tree/canary/examples/with-iron-session" rel="nofollow noreferrer">https://github.com/vercel/next.js/tree/canary/examples/with-iron-session</a></p>
  <p>I can sign in using <code>const { user, mutateUser } = useUser();</code> with <code>useUser()</code> being from the example: <a href="https://github.com/vercel/next.js/blob/canary/examples/with-iron-session/lib/useUser.js" rel="nofollow noreferrer">https://github.com/vercel/next.js/blob/canary/examples/with-iron-session/lib/useUser.js</a></p>
  <p>My sign-in method looks like this;</p>
  <pre><code>const signIn = async ({ email, password, remember_me }) =&gt; {
      try {
        await mutateUser(
          fetchJson(`${API.baseURL}/${API.signIn}`, {
            method: &quot;POST&quot;,
            headers: { 
              &quot;Accept&quot;: 'application/json',
              &quot;Content-Type&quot;: &quot;application/json&quot;
            },
            body: JSON.stringify({
              email,
              password
            })
          })
        );
      } catch (error) {
        console.error(&quot;An unexpected error happened:&quot;, error);
        setErrorMessage((&lt;p className=&quot;error&quot;&gt;{error.data.message}&lt;/p&gt;));
      }
  };
  </code></pre>
  <p>I can see my user change, but I still have the following issues:</p>
  <ol>
  <li>I don't see any cookies get created. Does with-iron-sessions require the site to be deployed to the vercel cloud in order for cookies to get added, or am I right in thinking I can use my own server and API endpoints?</li>
  <li>What's the pattern for using the <code>/api/user</code> endpoint in <a href="https://github.com/vercel/next.js/blob/canary/examples/with-iron-session/lib/useUser.js" rel="nofollow noreferrer">useUser.js</a>; does the endpoint look for the cookies (that are not getting created for me) and do it's own validation, or is there validation I need to do in my version of that endpoint? Is there an example of what that endpoint looks like server-side you might be able to point me to?</li>
  <li>Is there a way to refresh the cookie (once I get them to appear) so they are X days since <em>last</em> using the site instead of X days from <em>first</em> login so it's a sliding cookie lifespan, or does that happen automatically?</li>
  <li>When I sign out my sign_out endpoint returns a 204 status code but the UI doesn't change like it does when I sign in. Any tips for me there?
  Thank you!</li>
  </ol>