Hi, We are using okta-auth-js and okta-react libraries which seem to use cookies to auto renew access tokens. However, I have seen this new Refresh Token Rotation feature and was wondering by what date you’d recommend switching over to it? Is there a certain timeline that the current cookie method …

The functionality for silent renewal (where the authorize call is made in an iframe, aka, the cookie method you mentioned) are heavily dependent on the individual browsers default settings and when they each decide that they will start blocking third party cookies (Safari and Chrome Incognito alread…

@andrea just one more question. The article you linked specifically calls out that this is only an issue for customer hosted sign in widgets. Does that mean it’s not an issue for those using the okta hosted sign in widget? Or is that separate to the autoRenewal feature found in the okta-auth-js libr…

The FAQ mostly discusses that this issue crops up if you make a CORS request (that requires the session cookie be included) to Okta from a different domain than your Okta tenant. Even if you use the Okta hosted widget to handle the initial authentication, the silent auto-renewal done by the SDK will…

Excellent thanks for the clear answer @andrea .

The session cookie is called ‘sid,’ but you may find we set a few other cookies as well that are unrelated to session (with the exception of the cookies used to store tokens and oauth parameter information that the SDKs use).

By what date should we implement refresh token rotation?

Questions

ReturnOfTheMac July 8, 2021, 1:55pm 7

@andrea One last question, do you know what cookie is being used by Okta? Looking at firefox they disable cross site tracking by default now.

Post		Replies	Views
Is autoRenew the same as Refresh token rotation? Questions reactjs	4	6357	June 10, 2021
Okta-auth-js autoRenew process Questions	5	9501	February 2, 2021
What does refresh token lifetime do? Questions reactjs , sdk	5	8008	July 20, 2021
AutoRenew on React SPA Questions	5	4221	October 21, 2020
Auto Refresh Access Token and 3rd Party Cookies issues Questions	2	4847	July 10, 2020

By what date should we implement refresh token rotation?

Related topics