oidc-client-ts
oidc-client-ts copied to clipboard
Automatic silent renew doesn't use refresh token if access token is already expired
Related to #644, but not exactly the same, so decided to open this separately.
Reproducing
In a setup where:
- You save user state in
localStorage - You use refresh tokens
automaticSilentRenewis set totrue
If you open a page with an expired token, but a valid refresh token, oidc-client-ts doesn't use the refresh token to renew. Instead, it just gives up renewing completely.
Possible root causes
Upon digging a bit, I've found out that in AccessTokenEvents, we drop completely the timer when the user is expired, which is decided based on access token, instead of refresh token.