search

asgardeo / asgardeo-auth-react-sdk

To maintain the implementation of Asgardeo React authentication SDK
Apache License 2.0
40 stars 91 forks source link

How to handle expired refresh token state when the application tab is left unattended #181

Closed ayshsandu closed 1 year ago

ayshsandu commented 1 year ago

Describe the issue: My observation from an application that has SDK enabled 1 - login to the app 2 - let the tab idle for some time (more than the validity of the refresh token) 3 - come back to the application 4 - refresh the tab 5 - SDK tries to renew the token upon 401 response, but fails as the refresh token is expired 6 - But some controllers show as authenticated due to the state being persisted 7 - session data on the authentication state is not cleared

How to reproduce:

Expected behavior: When all the tokens are expired, At least at the page refresh SDK need to update the status, clan the authentication data from the browser, and reset to an unauthenticated state

DonOmalVindula commented 1 year ago

As an immediate fix, the SDK will log out the user if the refresh token is expired. This fix is available with v2.0.3 of the React SDK. As a future improvement, we should allow developer to pass a callback function to be executed on token expiry.