simple-oauth2
simple-oauth2 copied to clipboard
Cannot refresh a second time after the first refresh
Context
- node version: v19.7.0
- module version with issue: 5.0.0
- last module version without issue: unknown
- environment (e.g. node, browser, native): node
- any other relevant information:
What are you trying to achieve or the steps to reproduce?
- I am using authorization code flow to successfully fetch the first access token 1
- I can refresh token 1 to get token 2
- Token 2 cannot be refreshed because it no longer has a
refresh_tokenassociated. This is because our OAuth2/tokenendpoint will only provide a new refresh token if the original refresh token is still within 60% of is validity period. It doesn't echo back the original refresh token.
This behavior is acceptable per RFC 6749 Section 4.1.4
What was the result you got?
Got a token that cannot be refreshed while the initial refresh token is still valid.
What result did you expect?
Tokens should be refreshable until the current refresh token is no longer valid.
Perhaps the library could consider using the current refresh token if the response does not include one ?