Change in tokenManager:renew

[jpspringall]

Hi,

Not sure if this was intentional but as the part commit #906 the renew function in tokenManager.ts has been changed about line 412 from

this.state.renewPromise[key] = this.sdk.token.renew(token)
  .then(freshToken => {
	// store and emit events for freshToken
	const oldTokenStorage = this.storage.getStorage();
	this.remove(key);
	this.add(key, freshToken);
	this.emitRenewed(key, freshToken, oldTokenStorage[key]);
	return freshToken;
})

to

// A refresh token means a replace instead of renewal
// Store the renew promise state, to avoid renewing again
this.state.renewPromise = this.sdk.token.renewTokens()
  .then(tokens => {
	this.setTokens(tokens);

	// resolve token based on the key
	const tokenType = this.getTokenType(token);
	return tokens[tokenType];
})

The difference between the two renew functions is:

In the previous version, the call to this.sdk.token.renew(token) would use the scopes from the token being renewed in the renewal request.

In the current version, the call to this.sdk.token.renewTokens() uses the scopes as supplied by options.scopes

This means that if the tokens were originally acquired by a call similiar to:

getWithoutPrompt({
  clientId: this.environmentService.authentication.clientId,
  responseType: ['code'],
  scopes: this.environmentService.authentication.authScope,
  state: this.environmentService.authentication.state,
  nonce: this.environmentService.authentication.nonce,
  sessionToken: payload
})

The subsequent calls to renew may fail if the option.scopes has not been updated to the same scopes used in the original request.

Thanks

James

[oleksandrpravosudko-okta]

Thanks for pointing this out. Internal Ref: OKTA-429429

[aarongranick-okta]

@jpspringall We have pushed a fix for this issue in @okta/okta-auth-js version 5.7.0. If you are able, please confirm if updating to this version resolves your issue.

[jpspringall]

Thanks for this @aarongranick-okta. Unfortunately I'm not in a position to test at the moment, However looking at the code it looks like it will work, I'll reopen the ticket if if i find it doesnt work as part of next upgrade cycle.

Thanks

James