Skip to content

Token refresh error after being idle for few hours #1156

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
santosmken opened this issue Nov 10, 2021 · 3 comments
Open

Token refresh error after being idle for few hours #1156

santosmken opened this issue Nov 10, 2021 · 3 comments
Labels
bug For tagging faulty or unexpected behavior. investigation-needed Indication that the maintainer or involved community members may need to investigate more.

Comments

@santosmken
Copy link

santosmken commented Nov 10, 2021

Describe the bug
When I already had a successful http request and I set my device to (hibernate | sleep | shutdown) mode then I went back again to the web-app which I didn't close and make another http request, the token that is being sent to the api is not valid always. As a result, I got 401 every time and I have to reload the page to get a valid token from my IDp. Is there a proper way to handle it like via interceptor?

To Reproduce
Steps to reproduce the behavior:

  1. Go to the web-app and do some http call
  2. Shutdown or sleep or hibernate your device like an hour or less
  3. Go back to the web-app and do another http call
  4. IDp (Azure B2C) in my case returns "token_refresh_error" and as a result, the http request is always 401 unauthorized

Expected behavior
The incoming request after being idle for few hours should be valid and must be renew first before the actual http call since I provided the "allowedUrls" from the forRoot and enabled sendAcessToken.

Desktop (please complete the following information):

  • OS: any
  • Browser: any
  • Version: Latest

Additional context
The provided scope are:

  1. openid b2cClientId
  2. oidc: true
  3. strictDiscoveryDocumentValidation: false

In my APP_INITIALIZER, the steps I have are the ff:

  1. Load discovery document and tryLogin()
  2. Check if hasValidAccessToken. If true, I invoke setupAutomaticSilentRefresh() then resolve the Promise.
  3. When false, I invoke initCodeFlow then reject the Promise
@jeroenheijmans jeroenheijmans added bug For tagging faulty or unexpected behavior. investigation-needed Indication that the maintainer or involved community members may need to investigate more. labels Nov 10, 2021
@jeroenheijmans
Copy link
Collaborator

You might be partially running into #820?

Either way, it would be worth investigating if the library has some support for get-new-accesstoken-on-401s, or should get such.

In the mean time you can always create your application-specific HttpInterceptor. I think it is what I do in my production applications.

@santosmken
Copy link
Author

Yes @jeroenheijmans. Thanks for the input, I'll adjust my code.

@santosmken
Copy link
Author

Hello again @jeroenheijmans and to anyone who have this problem. I added more details in #820 and maybe someone can provide other details and solutions as workaround. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug For tagging faulty or unexpected behavior. investigation-needed Indication that the maintainer or involved community members may need to investigate more.
Projects
None yet
Development

No branches or pull requests

2 participants