botframework-sdk icon indicating copy to clipboard operation
botframework-sdk copied to clipboard

OAuthPrompt and OAuthInput should check token expiration

Open EricDahlvang opened this issue 4 years ago • 0 comments

Issue

The current recommendation is to not store tokens in the bot, but make a call to the service whenever a token is needed.

https://github.com/microsoft/BotBuilder-Samples/blob/main/samples/csharp_dotnetcore/18.bot-authentication/Dialogs/MainDialog.cs#L74

                // Call the prompt again because we need the token. The reasons for this are:
                // 1. If the user is already logged in we do not need to store the token locally in the bot and worry
                // about refreshing it. We can always just call the prompt again to get the token.
                // 2. We never know how long it will take a user to respond. By the time the
                // user responds the token may have expired. The user would then be prompted to login again.
                //
                // There is no reason to store the token locally in the bot because we can always just call
                // the OAuth prompt to get the token or get a new token if needed.

This is great. However, the tokens are sometimes expired. The service does not check this, and the sdk prompts do not check this: they just return the expired token.

Proposed change

Add code to OAuthPrompt and OAuthInput to logout the user, and re-show the sign-in prompt if the token is expired.

Component Impact

OAuthPrompt and OAuthInput will be more resilient.

Customer Impact

Customers will not be required to handle expired tokens in their code.

Tracking Status

Dotnet SDK TODO

  • [ ] PR
  • [ ] Merged

Javascript SDK TODO

  • [ ] PR
  • [ ] Merged

Python SDK TODO

  • [ ] PR
  • [ ] Merged

Java SDK TODO

  • [ ] PR
  • [ ] Merged

Samples TODO

  • [ ] PR
  • [ ] Merged

Docs TODO

  • [ ] PR
  • [ ] Merged

Tools TODO

  • [ ] PR
  • [ ] Merged

EricDahlvang avatar Dec 23 '20 20:12 EricDahlvang