Silent refresh token renew does not work

damienbod / angular-auth-oidc-client

npm package for OpenID Connect, OAuth Code Flow with PKCE, Refresh tokens, Implicit Flow

https://www.npmjs.com/package/angular-auth-oidc-client

MIT License

1.14k stars 430 forks source link

Silent refresh token renew does not work #999

Closed Manuel-Moya closed 3 years ago

Manuel-Moya commented 3 years ago

Describe the bug The token is never renewed, the first time tries to renew and raises an error.

To Reproduce Silent refresh token renw

Expected behavior It should refresh the token

Screenshots

Additional context I am using the example AzureAD-Auth-MyUI-with-MyAPI to reproduce the issue and the silent token refresh does not work

damienbod commented 3 years ago

The error says interaction required which means you are not logged in on the STS. If you are not logged in, then you can cannot refresh.

Greetings Damien

Manuel-Moya commented 3 years ago

I am logged in, and everything works properly until the token has to be refreshed silently.

damienbod commented 3 years ago

@Manuel-Moya Azure, this could be an Azure iframe problem as well. Can you try using refresh tokens?

Here's an example:

https://github.com/damienbod/AzureADAuthRazorUiServiceApiCertificate/blob/main/AngularAzureADMultipleApis/AngularAzureAD/src/app/app.module.ts#L19-L31

Manuel-Moya commented 3 years ago

@damienbod I have just tried using refresh tokens, but once the token has to be refreshed, it fails.

damienbod commented 3 years ago

This is a validation problem , disable the nonce validation for the refresh. You can see that the refresh has worked, but the client validation has failed.

Add this to your config:

ignoreNonceAfterRefresh: false

Don't now why I don't need this, just tested this with my Azure setup

Manuel-Moya commented 3 years ago

Setting ignoreNonceAfterRefresh: true as you suggested worked.

Thanks a lot for your assistance.

I will play around with my Azure setup to find an explanation about why it was not working.