[Question] How to manually refresh tokens

[jonsgreen]

Forgive me for my ignorance here as I am still trying to learn how this library works.

We are using your library in an application with a React front end and Rails api backend using doorkeeper with the token expiration set to 1 hour. We have a situation where sometimes the background token refresh fails to happen and so the stored token has become stale and so api requests to our backend fail. The token would refresh if requested but unfortunately it won't happen in the background automatically for up to an hour.

Is there a simple way to catch the api error and manually make a call to refresh the token using your library. I am seeing that the refreshAccessToken function is not exposed in the AuthContext and I am guessing that is intentional.

I am going to keep exploring on my own and will close this issue myself if I figure it out but I thought I would post it in case the maintainers of the library can save me some time and point me in the right direction.

Thanks!

[sebastianvitterso]

What we often do as a "hack" when testing new functionality, is to just set the token expiration to 0 (basically jan 1st 1970).

So you could write a simple function like:

function triggerTokenRefresh() {
  window.localStorage.setItem("ROCP_tokenExpire", 0)
}

Note that this won't make it trigger immediately, but at some time within the next 15 seconds.

---

Otherwise, as most other libraries, the main functionality is built to "depend" on other components working as intended, so I don't see us exposing the refresh-function any time soon.

[jonsgreen]

@sebastianvitterso thanks so much for responding to my question so quickly and converting this to a discussion.

My sense is that our scenario must be pretty common and so I am guessing we must be not configuring our application in a proper way and I am wondering if someone could point us in the right direction.

To explain again we are doing a get request on the root page of our React app. You need to be authenticated in order to access that page and so far we just check that there is a token in localStorage needed for the request. If someone has closed their tabs and then returns after the expiry time for the token then we get a 401. The token then refreshes and repairs itself in the next 15 seconds or so like you suggest but it creates a bad initial experience for the user.

I am curious how you or others would suggest handling this scenario more gracefully. Should we be checking ourselves whether the token is expired before making the api request? Is there some kind of configuration that we are missing?

I still feel like it would be helpful if we could "manually" refresh the token if we get a 401 response and not have to wait the interval for the refresh to happen in the background. We would be happy to contribute to a PR if that seems like it would be a valid, reasonable feature that the library wants to support.

Let me know if any of this is unclear. Thanks again for the help!

[jonsgreen]

Also, I am really curious about how I can publish the dist folder locally so that I can test changes locally to try things out.

[sebastianvitterso]

What do you mean by "publish the dist folder", in this context?
If you'd like to run the library locally, read the "Develop" section of the readme. It's fairly simple to get started. 😄

Good luck!

[Ma-ve]

Heya @jonsgreen - did you ever figure out an alternative?

[soofstad]

You should verify that the token_expire, and refresh_token_expire values are returned from the auth server, and are set in localStorage.
And also you should implement the onRefreshTokenExpire-callback function.
Have a look in https://github.com/soofstad/react-oauth2-pkce?tab=readme-ov-file#configuration-parameters to see what parameters you might need to set.
To debug any further, it would be interesting to see the /token-responses you receive.

[Ma-ve]

@soofstad

To piggyback off of this: how about the situation where the access token is valid for 24 hours, and the refresh token is valid for 30 days. Say you log in at at Monday, 10:00. You leave the page, and you don't back, until Tuesday 11:00. You open a new tab, and the access token has expired. The first API call that happens, a simple /me call, fails, because of a 401 Unauthorized.

Wouldn't it make sense to call the refreshAccessToken() in that case?

Or, another case: if someone has revoked existing sessions/authorizations, by changing their password, so the API calls would return 401. Their refresh token would have been revoked too, but that's absolutely fine, as the refreshAccessToken does a logIn because of config.autoLogin.

Am I missing something, or would these be legitimate use cases that are not covered right now?

[hridaya2004]

Is there any way to find out whether the access token are actually being refreshed? Because setting "tokenExpire" to 0 as said in this comment clearly didn't work for me, polled every 2 seconds for 30 seconds and found out it never refreshed the access token.

We clearly wouldn't want user to get denied access just because their token got expired every 5 minutes, refresh tokens are there for a reason, and redirecting user to login page just feels stupid, if we can prevent it simply just by exporting the function from the library itself.

[soofstad]

If you are experiencing any issues @hridaya2004, please describe it providing all relevant details. Particularly requests going to your auth server. Both request- and response data.

[hridaya2004]

Particularly requests going to your auth server.

Well, that is my issue there, requests are not being made to auth server when tokenExpire is set to 0. So, my question was how to verify if the refresh access token mechanism is actually working or not.

I followed your instruction from here, where I did a dummy request giving me 403, and I am supposed to refresh the token if that happens, so obviously I tried to kick off the automatic access token refresh mechanism, and set the tokenExpire to 0 as suggested here. And from that I kept checking for new access token each 2 seconds for 30 seconds, but it never got updated, nor did any request was sent to auth server.

[soofstad]

Interesting. Would you mind creating a new issue for this?
And please add you configuration and minimum code to reproduce the bug

[hridaya2004]

Interesting. Would you mind creating a new issue for this? And please add you configuration and minimum code to reproduce the bug

Done. #227