search

leancodepl / flutter_corelibrary

Our core packages used for building the best Flutter apps.
https://pub.dev/publishers/leancode.co
57 stars 7 forks source link

Avoid using stored tokenEndpoint for credentials refresh to prevent authentication issues when auth server URL changes #334

Closed lukaszgarstecki closed 2 months ago

lukaszgarstecki commented 3 months ago

Currently login_client_flutter saves Credentials object that contains tokenEndpoint that may change in time (eg. auth server url may change).

Should we assume that we want to use in order to authenticate the user when the access token expires? Currently we use tokenEndpoint that is stored within the app keychain. This means that if someone is logged in to the app, they won't be able to refresh their credentials until the application won't clear the stored Credentials.

Proposed solution:

If we were to refresh credentials we should use auth server endpoint defined in here, not the one we store in the keychain.