[SDK-1877] Add refresh method to access token #124

adamjmcgrath · 2020-08-10T14:11:31Z

Description

You should be able to use the openid-client to refresh an access token.

let accessToken = req.oidc.accessToken;
if (accessToken.isExpired()) {
  accessToken = await accessToken.refresh();
}

Also, add fetchUserInfo for completeness

const userInfo = await req.oidc.fetchUserInfo();

References

https://github.com/panva/node-openid-client/blob/master/docs/README.md#clientrefreshrefreshtoken-extras
https://github.com/panva/node-openid-client/blob/master/docs/README.md#clientuserinfoaccesstoken-options

Testing

This change adds test coverage for new/changed/fixed functionality

Checklist

I have added documentation for new/changed functionality in this PR or in auth0.com/docs
All active GitHub checks for tests, formatting, and security are passing
The correct base branch is being used, if not master

panva · 2020-08-10T14:35:43Z

lib/context.js

+  const oldTokenSet = tokenSet.call(this);
+  const newTokenSet = await client.refresh(oldTokenSet, opts);


It is entirely possible that a refresh() will only yield the access token and no refresh_token. We should look for that specific scenario and keep the old refresh token value.

Good point, thanks!

panva · 2020-08-10T14:37:45Z

index.d.ts

+  fetchUserInfo(options?: {
+    verb?: 'GET' | 'POST';
+    via?: 'header' | 'body' | 'query';
+    tokenType?: string;
+    params?: object;
+  }): Promise<UserinfoResponse>;


my recommendation: don't expose any of these options. The default is the REQUIRED to implement for all providers that support the userinfo endpoint.

panva · 2020-08-10T14:39:06Z

lib/context.js

@@ -112,6 +127,13 @@ class RequestContext {
      return undefined;
    }
  }
+
+  async fetchUserInfo(opts) {


my recommendation: don't expose the options. The default is the REQUIRED to implement for all providers that support the userinfo endpoint.

panva · 2020-08-10T14:39:50Z

index.d.ts

+   *
+   * @param opts Add extra parameters to the Token Endpoint Request and/or Client Authentication JWT Assertion
+   */
+  refresh(opts?: RefreshExtras): Promise<AccessToken>;


omit the options.

panva · 2020-08-10T14:40:10Z

lib/context.js

@@ -15,6 +15,20 @@ function isExpired() {
  return tokenSet.call(this).expired();
 }

+async function refresh(opts) {


omit the options.

…ating) and remove unneeded opts

* Add refresh method to access token * Add method to fetch userinfo * Add refresh example to docs * Not all refresh token grants get a new refresh token back (eg non rotating) and remove unneeded opts

* Update beta version * Initial commit of Beta 2 branch Co-authored-by: Filip Skokan <[email protected]> * Add PKCE tests and fix multiple servers in tests (#110) * [SDK-1714] [SDK-1723] Session cookie checks (#111) * Refactor the tests a little to use a server * simplify test * tests for unordered cookie chunks * Test format changes for transient handler * Update lib/transientHandler.js Co-authored-by: Filip Skokan <[email protected]> * [SDK-1715] Configuration and API updates (#109) * Simplify the config tests, test more with less code * Validate config fixes and tests * Add comment, update tests * `Issuer.discover` only takes a fully qualified url * Simpler scope assertion and keep all config tests in same file * Let auth server set default for response_type: code * clientSecret is required for HS* algs regardless of response_type Co-authored-by: Filip Skokan <[email protected]> * [SDK-1712] Test token set (#108) * Add tests for TokenSet * Refactor the tests a little * Split up code flow tests * Add tests for access token expiry * Add Prettier for style formatting (#112) * Add prettier * Run `prettier --write .` * [SDK-1716] Add tests for claim* MW (#113) * Add tests for claim* MW * Fix tests * Add some tests for session duration behaviour * Revert "Add some tests for session duration behaviour" This reverts commit e3ce510. * Add some tests for session duration behaviour (#114) * Add test for passing custom param to logout (#115) * [SDK-1721] Auto generated docs (#117) * Auto generated docs with typedoc * fix lgtm * Fix auth params * Fix incorrect import of `requiresAuth` (#118) * Add TROUBLESHOOTING and update debug logging (#120) * Add TROUBLESHOOTING and update debug logging * fix tests * Update lib/context.js Co-authored-by: Filip Skokan <[email protected]> Co-authored-by: Filip Skokan <[email protected]> * attemptSilentLogin feature (#121) * attemptSilentLogin feature * Resume silent login after successful login so that users try silent login again after their session's expire * `postLogoutRedirectUri` isn't always a URI and login needs a check for `response_type` (#123) * [SDK-1877] Add refresh method to access token (#124) * Add refresh method to access token * Add method to fetch userinfo * Add refresh example to docs * Not all refresh token grants get a new refresh token back (eg non rotating) and remove unneeded opts * Scope all cookies (skipSilentLogin, transient and appSession) to the app session cookie path and domain config (if specified) (#125) * [SDK-1722] Architecture (#128) * Default Login flow docs * Add logout * add link from readme * [SDK-1876] [SDK-1726] Add samples and smoke tests (#127) * Add samples and smoke tests * Fix CI * Make the test clearer that discovery alg is ignored (#130) * Make the test clearer that discovery alg is ignored * Add test to show "none" disallowed for idTokenSigningAlg * Disallow "none" in any case (#131) * Disallow "none" in any case * Fix puppeteer in CircleCI https://github.com/puppeteer/puppeteer/blob/main/docs/troubleshooting.md#running-puppeteer-on-circleci * Revert "Fix puppeteer in CircleCI https://github.com/puppeteer/puppeteer/blob/main/docs/troubleshooting.md#running-puppeteer-on-circleci" This reverts commit c0fd31e * use active lts * [SDK-1914] Add a migration guide for v1 to v2 (#129) * Add a migration guide for v1 to v2 * Apply suggestions from code review Co-authored-by: Filip Skokan <[email protected]> * Updates per PR comments Co-authored-by: Filip Skokan <[email protected]> * Release 2.0.0-beta.0 (#132) * Release 2.0.0-beta.0 * Ignore docs from lint * Fixes the numbering on examples (#136) * chore: update jose and openid-client (#134) Co-authored-by: Filip Skokan <[email protected]> Co-authored-by: David Patrick <[email protected]>

abinashdatta · 2021-09-13T17:17:46Z

How we can refresh the token without deleting the current session. I am getting an issue like after every refresh auth code flow is re-invoked.

adamjmcgrath added 3 commits August 10, 2020 15:05

Add refresh method to access token

3ba29e6

Add method to fetch userinfo

0885357

Add refresh example to docs

cce9b30

adamjmcgrath added the review:medium Medium review label Aug 10, 2020

adamjmcgrath requested review from panva and a team August 10, 2020 14:11

panva suggested changes Aug 10, 2020

View reviewed changes

Not all refresh token grants get a new refresh token back (eg non rot…

bd789a7

…ating) and remove unneeded opts

adamjmcgrath requested a review from panva August 10, 2020 16:08

panva approved these changes Aug 10, 2020

View reviewed changes

adamjmcgrath merged commit caf1de4 into beta-2 Aug 10, 2020

adamjmcgrath deleted the refresh-token branch August 10, 2020 17:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SDK-1877] Add refresh method to access token #124

[SDK-1877] Add refresh method to access token #124

adamjmcgrath commented Aug 10, 2020

panva Aug 10, 2020

adamjmcgrath Aug 10, 2020

panva Aug 10, 2020

panva Aug 10, 2020

panva Aug 10, 2020

panva Aug 10, 2020

abinashdatta commented Sep 13, 2021

		const oldTokenSet = tokenSet.call(this);
		const newTokenSet = await client.refresh(oldTokenSet, opts);

[SDK-1877] Add refresh method to access token #124

[SDK-1877] Add refresh method to access token #124

Conversation

adamjmcgrath commented Aug 10, 2020

Description

References

Testing

Checklist

panva Aug 10, 2020

Choose a reason for hiding this comment

adamjmcgrath Aug 10, 2020

Choose a reason for hiding this comment

panva Aug 10, 2020

Choose a reason for hiding this comment

panva Aug 10, 2020

Choose a reason for hiding this comment

panva Aug 10, 2020

Choose a reason for hiding this comment

panva Aug 10, 2020

Choose a reason for hiding this comment

abinashdatta commented Sep 13, 2021