You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn how to retrieve tokens and refresh tokens and extend sessions when using the built-in authentication and authorization in App Service.
4
-
ms.topic: article
2
+
title: Work with OAuth Tokens in AuthN/AuthZ
3
+
description: Learn how to retrieve tokens, refresh tokens, and extend sessions when you use the built-in authentication and authorization in Azure App Service.
4
+
ms.topic: how-to
5
5
ms.date: 03/29/2021
6
6
ms.custom: AppServiceIdentity
7
7
author: cephalin
@@ -10,40 +10,41 @@ ms.author: cephalin
10
10
11
11
# Work with OAuth tokens in Azure App Service authentication
12
12
13
-
This article shows you how to work with OAuth tokens while using the built-in [authentication and authorization in App Service](overview-authentication-authorization.md).
13
+
This article shows you how to work with OAuth tokens when you use the built-in [authentication and authorization in Azure App Service](overview-authentication-authorization.md).
14
14
15
15
## Retrieve tokens in app code
16
16
17
-
From your server code, the provider-specific tokens are injected into the request header, so you can easily access them. The following table shows possible token header names:
17
+
From your server code, the provider-specific tokens are injected into the request header so that you can easily access them.
18
+
19
+
The following table lists possible token header names:
| X | `X-MS-TOKEN-TWITTER-ACCESS-TOKEN` <br/> `X-MS-TOKEN-TWITTER-ACCESS-TOKEN-SECRET` |
25
-
|||
26
27
27
28
> [!NOTE]
28
-
> Different language frameworks may present these headers to the app code in different formats, such as lowercase or title case.
29
+
> Different language frameworks might present these headers to the app code in different formats, such as in lowercase or by using title case.
29
30
30
31
From your client code (such as a mobile app or in-browser JavaScript), send an HTTP `GET` request to `/.auth/me` ([token store](overview-authentication-authorization.md#token-store) must be enabled). The returned JSON has the provider-specific tokens.
31
32
32
33
> [!NOTE]
33
-
> Access tokens are for accessing provider resources, so they are present only if you configure your provider with a client secret. To see how to get refresh tokens, see Refresh access tokens.
34
+
> Access tokens are for accessing provider resources, so they're present only if you configure your provider with a client secret.
34
35
35
36
## Refresh auth tokens
36
37
37
-
When your provider's access token (not the [session token](#extend-session-token-expiration-grace-period)) expires, you need to reauthenticate the user before you use that token again. You can avoid token expiration by making a `GET` call to the `/.auth/refresh` endpoint of your application. When called, App Service automatically refreshes the access tokens in the [token store](overview-authentication-authorization.md#token-store) for the authenticated user. Subsequent requests for tokens by your app code get the refreshed tokens. However, for token refresh to work, the token store must contain [refresh tokens](/entra/identity-platform/refresh-tokens) for your provider. The way to get refresh tokens are documented by each provider, but the following list is a brief summary:
38
+
When your provider's access token (not the [session token](#extend-session-token-expiration-grace-period)) expires, you need to reauthenticate the user before you use that token again. You can avoid token expiration by making a `GET` call to the `/.auth/refresh` endpoint of your application. When called, App Service automatically refreshes the access tokens in the [token store](overview-authentication-authorization.md#token-store) for the authenticated user. Subsequent requests for tokens by your app code get the refreshed tokens. However, for token refresh to work, the token store must contain [refresh tokens](/entra/identity-platform/refresh-tokens) for your provider. The way to get refresh tokens is documented by each provider, but the following list is a brief summary:
38
39
39
40
- **Google**: Append an `access_type=offline` query string parameter to your `/.auth/login/google` API call. For more information, see [Google Refresh Tokens](https://developers.google.com/identity/protocols/OpenIDConnect#refresh-tokens).
40
41
- **Facebook**: Doesn't provide refresh tokens. Long-lived tokens expire in 60 days (see [Long-Lived Access Tokens](https://developers.facebook.com/docs/facebook-login/guides/access-tokens/get-long-lived/)).
41
42
- **X**: Access tokens don't expire (see [OAuth FAQ](https://developer.x.com/en/docs/authentication/faq)).
42
43
- **Microsoft**: In [https://resources.azure.com](https://resources.azure.com), do the following steps:
43
-
1. At the top of the page, select **Read/Write**.
44
-
2. In the left browser, navigate to **subscriptions** > **_\<subscription\_name>_** > **resourceGroups** > **_\<resource\_group\_name>_** > **providers** > **Microsoft.Web** > **sites** > **_\<app\_name>_** > **config** > **authsettingsV2**.
45
-
3. Click **Edit**.
46
-
4. Modify the following property.
44
+
1. At the top of the pane, select **Read/Write**.
45
+
1. On the explorer menu, go to **subscriptions** > *subscription name* > **resourceGroups** > *resource group name* > **providers** > **Microsoft.Web** > **sites** > *app name* > **config** > **authsettingsV2**.
46
+
1. Select **Edit**.
47
+
1. Modify the following property:
47
48
48
49
```json
49
50
"identityProviders": {
@@ -55,14 +56,14 @@ When your provider's access token (not the [session token](#extend-session-token
55
56
}
56
57
```
57
58
58
-
5. Click **Put**.
59
-
59
+
1. Select **Put**.
60
+
60
61
> [!NOTE]
61
-
> The scope that gives you a refresh token is [offline_access](../active-directory/develop/v2-permissions-and-consent.md#offline_access). See how it's used in [Tutorial: Authenticate and authorize users end-to-end in Azure App Service](tutorial-auth-aad.md). The other scopes are requested by default by App Service already. For information on these default scopes, see [OpenID Connect Scopes](../active-directory/develop/v2-permissions-and-consent.md#openid-connect-scopes).
62
+
> The scope that gives you a refresh token is [offline_access](../active-directory/develop/v2-permissions-and-consent.md#offline_access). See how it's used in [Tutorial: Authenticate and authorize users end to end in Azure App Service](tutorial-auth-aad.md). The other scopes are already requested by App Service by default. For information on these default scopes, see [OpenID Connect Scopes](../active-directory/develop/v2-permissions-and-consent.md#openid-connect-scopes).
62
63
63
-
Once your provider is configured, you can [find the refresh token and the expiration time for the access token](#retrieve-tokens-in-app-code) in the token store.
64
+
After your provider is configured, you can [find the refresh token and the expiration time for the access token](#retrieve-tokens-in-app-code) in the token store.
64
65
65
-
To refresh your access token at any time, just call `/.auth/refresh` in any language. The following snippet uses jQuery to refresh your access tokens from a JavaScript client.
66
+
To refresh your access token at any time, call `/.auth/refresh` in any language. The following snippet uses jQuery to refresh your access tokens from a JavaScript client.
66
67
67
68
```javascript
68
69
function refreshTokens() {
@@ -75,25 +76,24 @@ function refreshTokens() {
75
76
}
76
77
```
77
78
78
-
If a user revokes the permissions granted to your app, your call to `/.auth/me` may fail with a `403 Forbidden` response. To diagnose errors, check your application logs for details.
79
+
If a user revokes the permissions granted to your app, your call to `/.auth/me` might fail with a `403 Forbidden` response. To diagnose errors, check your application logs for details.
79
80
80
81
## Extend session token expiration grace period
81
82
82
-
The authenticated session expires after 8 hours. After an authenticated session expires, there is a 72-hour grace period by default. Within this grace period, you're allowed to refresh the session token with App Service without reauthenticating the user. You can just call `/.auth/refresh` when your session token becomes invalid, and you don't need to track token expiration yourself. Once the 72-hour grace period lapses, the user must sign in again to get a valid session token.
83
+
The authenticated session expires after 8 hours. After an authenticated session expires, a 72-hour grace period follows by default. Within this grace period, you're allowed to refresh the session token with App Service without reauthenticating the user. You can just call `/.auth/refresh` when your session token becomes invalid, and you don't need to track token expiration yourself. When the 72-hour grace period lapses, the user must sign in again to get a valid session token.
83
84
84
-
If 72 hours isn't enough time for you, you can extend this expiration window. Extending the expiration over a long period could have significant security implications (such as when an authentication token is leaked or stolen). So you should leave it at the default 72 hours or set the extension period to the smallest value.
85
+
If 72 hours isn't enough time for you, you can extend this expiration window. Extending the expiration over a long period could have significant security implications (such as when an authentication token is leaked or stolen). We recommend that you leave the setting at the default 72 hours or set the extension period to the smallest value.
85
86
86
-
To extend the default expiration window, run the following command in the [Cloud Shell](../cloud-shell/overview.md).
87
+
To extend the default expiration window, run the following command in [Azure Cloud Shell](../cloud-shell/overview.md).
87
88
88
89
```azurecli-interactive
89
90
az webapp auth update --resource-group <group_name> --name <app_name> --token-refresh-extension-hours <hours>
90
91
```
91
92
92
93
> [!NOTE]
93
-
> The grace period only applies to the App Service authenticated session, not the tokens from the identity providers. There is no grace period for the expired provider tokens.
94
+
> The grace period only applies to the App Service authenticated session, not to the tokens from the identity providers. No grace period exists for expired provider tokens.
94
95
>
95
96
96
-
## Next steps
97
+
## Related content
97
98
98
-
> [!div class="nextstepaction"]
99
-
> [Tutorial: Authenticate and authorize users end-to-end](tutorial-auth-aad.md)
99
+
- [Tutorial: Authenticate and authorize users end to end](tutorial-auth-aad.md)
0 commit comments