-
Notifications
You must be signed in to change notification settings - Fork 18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
refreshAccessToken gets new refreshToken #22
Comments
Hello, thank you for taking the time to contribute! This behavior is controlled by the |
I've thought about this behavior a little too, but what's really been on my mind lately is this; I've been logging a message inside the "on token" event |
@marknokes that sounds like a race condition in which case a lock would be a nice thing to have. we'll first need a test to recreate the issue. would you like to give it a go? |
I'm not sure I would know where to start, tbh. I found the refreshAndRetry method, and thought it could perhaps be the culprit. I don't really know how to test it though. |
In src/client/resources/tokens.js there is a refreshAccessToken function. The function is intended to use an unexpired refreshToken to refresh an expired accessToken. In the function the parameter 'access_type' is being set to 'offline'. Per the documentation, "Set to offline to receive a refresh token on an authorization_code grant type request. Do not set to offline on a refresh_token grant type request."
My understanding is that this should only be set to offline when requesting the initial tokens (with the 'code' from the redirectURI).
When tested with 'offline' - this it returns both a refresh and access token.
When tested without 'offline' - this ONLY returns an access token (leaving the unexpired refreshToken still valid).
I will put together a PR for this change.
The text was updated successfully, but these errors were encountered: