# How we can implement refresh token with /authorize and /token in grails **URL:** \ **Category:** Questions\ **Created:** [May 5, 2021, 10:59am UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104 "2021-05-05T10:59:24Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![jyoti](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@jyoti](https://devforum.okta.com/u/jyoti)\ **Post date:** [May 5, 2021, 10:59am UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/1 "2021-05-05T10:59:24Z")
i want to generate refresh token with ouath2 api from server.but how we can implement it with grails? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [May 6, 2021, 8:24pm UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/2 "2021-05-06T20:24:39Z")
I can’t speak for grails specifically, but as long is the application is configured to allow use of the Refresh token grant, you can get refresh tokens returned from the token endpoint (when using authorization code flow) if you request the “offline\_access” scope in your authorize request. More details about refresh tokens found in our guide [here](https://developer.okta.com/docs/guides/refresh-tokens/overview/). @mraible, have any ideas for how to do this with grails? ---
**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\ **Post date:** [May 6, 2021, 9:38pm UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/3 "2021-05-06T21:38:03Z")
We do have a Grails tutorial on the developer blog: [Build Server Side Authentication in Grails with OAuth 2.0 and Okta | Okta Developer](https://developer.okta.com/blog/2018/04/19/okta-with-grails) ---
**Author:** ![jyoti](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@jyoti](https://devforum.okta.com/u/jyoti)\ **Post date:** [May 7, 2021, 5:45am UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/6 "2021-05-07T05:45:14Z")
thanks…mraible !! But to get a refresh token, i wanted to call following api authorizeUrl: ‘https://{yourOktaDomain}/oauth2/default/v1/authorize’ which will return authorization\_code in browser url like yourApp:/callback?code=BdLDvZvO3ZfSwg-asLNk&state=state-8600b31f-52d1-4dca-987c-386e3d8967e9 so how can i captured this authorization\_code from URL in grails?? is there any way to get auth\_code from browser to server?? ---
**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\ **Post date:** [May 7, 2021, 11:52am UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/7 "2021-05-07T11:52:30Z")
@andrea Already explained how to get a refresh token. It’s all about passing in the `offline_access` scope and configuring your Okta OIDC app to allow refresh tokens. From there, everything should work. Have you tried the Grails tutorial I linked to? You might be making this harder than you need to. I think the Grails code in the tutorial will work and you don’t have to worry about the code returned or talking to another endpoint. ---
**Author:** ![jyoti](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@jyoti](https://devforum.okta.com/u/jyoti)\ **Post date:** [May 11, 2021, 9:48am UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/8 "2021-05-11T09:48:21Z")
In our angular application we have implemented okta for user authentication for every request that hit our application. Each request is authenticated using token generated by okta and it gets validated through introspect api and it works fine. With these user interactions if the token gets expired we redirect user to home page so that new token gets generated. Now in this scenario, instead of redirecting user to home page, we need to refresh the token without intervention of the user and to achieve this need to generate refresh token from back end, so how the token can be refreshed offline without letting the user know about it ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [May 11, 2021, 3:19pm UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/9 "2021-05-11T15:19:21Z")
What is your use case that would make you/your users expect that the user would know about the refresh token being used to extend their session? Instead of having to redirect the user back to the home page to re-authenticate, you will instead have your application simply fetch a new token for them without them needing to re-authenticate or do anything else. Also, the “offline” part of the offline\_access scope is a little confusing. API calls still need to be made to Okta to get a new token (via the /token endpoint), but with an offline access token, the user does not need to be present/logged in to get new tokens, they just need a valid refresh token. See [OpenID spec here](https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess) for details about this scope ---
**Author:** ![axelkouassi](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@axelkouassi](https://devforum.okta.com/u/axelkouassi)\ **Post date:** [January 7, 2022, 3:13pm UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/10 "2022-01-07T15:13:31Z")
I have tried that tutorial, and it’s now outdated due to the Okta Grails plugin no longer being available. The bintray repository where the Okta Grails plugin was hosted, has been shut down. Trying that project, the build fails because of that Okta dependency, since the repository no longer exists. Without it, another way has to be implemented to use Okta. It will be nice to have that update, ideally for people like me working on legacy applications using Grails as the back-end. Most of the applications I work with are in Grails 2.x to Grails 3.x. I hope the Okta team will also think about us. ---
**Author:** ![axelkouassi](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@axelkouassi](https://devforum.okta.com/u/axelkouassi)\ **Post date:** [January 7, 2022, 3:16pm UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/11 "2022-01-07T15:16:47Z")
Can you share your logic for the validation of the REST API from the front-end, I am working on a Grails back-end with a react front-end, however I am not sure what’s the best process to deal with the implementation of the rest services to handle Okta. A simple example will be nice to see. Thank you. ---
**Author:** ![jmussman](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/jmussman/32/2175_2.png) [@jmussman](https://devforum.okta.com/u/jmussman)\ **Post date:** [January 7, 2022, 6:51pm UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/12 "2022-01-07T18:51:42Z")
I haven’t touched Grails since the pandemic started, but shouldn’t you really ought to be able to leverage the Java authentication SDK to do the auth-code-flow? I used to teach Grails all the time and linked a lot of Java to it. ---
**Author:** ![jmussman](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/jmussman/32/2175_2.png) [@jmussman](https://devforum.okta.com/u/jmussman)\ **Post date:** [January 7, 2022, 6:53pm UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/13 "2022-01-07T18:53:24Z")
On your second post here, define “validation of the REST API from the front-end”, I’m not sure what you are trying to achieve. I’ll be happy to help you out with it though. ---
**Author:** ![axelkouassi](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@axelkouassi](https://devforum.okta.com/u/axelkouassi)\ **Post date:** [January 8, 2022, 12:16am UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/14 "2022-01-08T00:16:03Z")
I am using a simple Enterprise Grails 2.4.5 secured by Okta default generated /users API through the “url mappings” configuration. I am able to see the REST JSON response on the browser going through Okta (probably because Okta is implemented throughout the enterprise) without any issue. however when I have an Okta secured React Front-End app that calls that API, a CORS error appears. I also tried to test those default generated APIs on Postman and I am getting a 404 not found error. I am using an access token inside the header in all scenarios. The app is using a custom Enterprise Grails Okta OAuth plugin. All APIs require authentication through the @Secured (IS\_AUTHENTICATED\_FULY) from the spring-security-core plugin that works with that custom Okta grails plugin through the Grails controller classes. The React front-end also uses Okta for authentication. I haven’t implemented any token decoder and verifier to check the validity of the token before returning the response, and even without that, it works in the browser. I am just trying to understand why I can’t even see the response on Postman. I followed one of the official examples from Okta (“Custom Okta Spring Boot Login Page”), and I also had a CORS issue. I had to add the custom endpoint “8080/custom-login” as a trusted origin inside my personal private okta admin console under “Security/API/Trusted Origin/Add Origin”. I just wonder if that’s something I have to do for that Enterprise Grails application and add that endpoint inside the enterprise Okta Admin Console. Thank you very much, I hope that helps clarify a bit. ---
**Author:** ![axelkouassi](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@axelkouassi](https://devforum.okta.com/u/axelkouassi)\ **Post date:** [January 8, 2022, 12:20am UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/15 "2022-01-08T00:20:18Z")
The project I am working on is on Groovy, but since it’s based on Java, I am sure it’s possible to use Java since there are a lot of Okta dependencies on maven that work well with Spring/Spring Boot/Java. Ideally don’t want to add another Okta dependency since I am using already a custom OAuth Plugin that secures the application with Okta. Mostly looking for the logical steps to implement the most basic controller and secure it with Okta that can accept request from a React App. ---
**Author:** ![jmussman](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/jmussman/32/2175_2.png) [@jmussman](https://devforum.okta.com/u/jmussman)\ **Post date:** [January 8, 2022, 2:31am UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/16 "2022-01-08T02:31:59Z")
If I am reading this correctly it seems that you are a) trying to use the Okta API from a grails (server-side) app, b) from a client-side React app, and c) from Postman to check things. Which can be confusing because there are three different ways to do things here. Sorry this is going to be a bit long, and let’s back away from any framework for the moment which just confuses the situation: 1. On a server-side app we normally issue an API token to access the Okta API. This is a sensitive token, it is the only credential needed with administrative access to the API. The API URL is always https://[your tenant server]/api/v1/[something like users. See this page for details: [Create an API token | Okta Developer](https://developer.okta.com/docs/guides/create-an-api-token/main/), and here is the full API documentation: [Core Okta API | Okta Developer](https://developer.okta.com/docs/reference/core-okta-api/). An API token can be used to access both groups of APIs, authentication and management. 2. On a client-side app (browser or device native) we never use an API token because it’s too risky and we don’t trust the user. So once the user is authenticated the app that initiated authentication can get an ID token and access token for the API. The ID token describes the user, the access token is used to make API calls. Now there are some limitations here: 3. Postman complicates things because there are two ways to use it. First off, if you are getting a 404 error your URL isn’t right (see above). Back to the end of your question: do you have to enable CORS in Okta for the Grails app? Not if you are using an API token, but probably if you are using an access token (and set the “origin” in the header properly). I haven’t actually tested that 🙂 Now for your last post, that looks like a whole different problem unless I’m reading it wrong. Do you want to build your own API (I assume in Grails) and secure it with an access token issued to the React app by Okta? ---
**Author:** ![axelkouassi](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@axelkouassi](https://devforum.okta.com/u/axelkouassi)\ **Post date:** [January 11, 2022, 1:41am UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/17 "2022-01-11T01:41:56Z")
> [@jmussman](#): > > On a server-side app we normally issue an API token to access the Okta API. This is a sensitive token, it is the only credential needed with administrative access to the API. The API URL is always https://[your tenant server]/api/v1/[something like users. See this page for details: [Create an API token | Okta Developer](https://developer.okta.com/docs/guides/create-an-api-token/main/), and here is the full API documentation: [Core Okta API | Okta Developer](https://developer.okta.com/docs/reference/core-okta-api/). An API token can be used to access both groups of APIs, authentication and management. I was able to access most of the Okta APIs using an access token from Postman as well as my default Grails APIs created in UrlMappings.groovy, using the client\_credentials grant\_type and the authorization\_code grant\_type: ```auto '/api/v1/users'(resources:'user') "/api/v1/user/$username"(controller:'user', action:"findByUsername", method: 'GET') ``` ```auto package com.xxx.xxx.controller import grails.converters.JSON import grails.rest.RestfulController import grails.plugin.springsecurity.annotation.Secured @Secured(['IS_AUTHENTICATED_FULLY']) class UserController extends RestfulController { static responseFormats = ['json'] UserController(){ super(User) } def index(){ def users = User?.list(max:5, sort: "username", order:"asc") render(users as JSON) } def show(){ def user = User.findById(params?.id) render(user as JSON) } def findByUsername(String username){ def userWithUsername = User?.findByUsername(params?.username?.toString()) render(userWithUsername as JSON) } } ``` However, for the Grails 2.4.5 APIs server-side APIs, I couldn’t use the Access Token obtained from the client\_credentials grant\_type, as it triggered an “Unauthorized 401 response”, most likely because the Access Token obtained through that grant type doesn’t contain any information about the user and I put an @Securedred annotation on my controller, hence requiring authentication first, before accessing any API. I had to use the cookie created when the application launched from IntelliJ ( It’s a Grails 2.4.5 Web App that I am trying to convert into a Web Service with a separate React Front-End.) and automatically authenticated the user through Okta, and add it inside the header of the request without any access token (no oauth) to access my created APIs and get a JSON response. I am now good on getting an Access Token and use it to access Okta APIs and my custom Server Side APIs. ✅ > b. The client-side application URL (protocol, server, and port number only) has to be registered as a trusted origin in Okta. Specifically if this isn’t done then Okta doesn’t respond with the access-control-allow-origin header in the response and the browser sees the CORS error. > I will try your suggested solutions to deal with CORS as well as go through all the other suggested solutions to have a better understanding. I still have a CORS issue when the React Front-End tries to access the server-side APIs even with the Access Token (obtained after the user logged in successfully) that works on Postman and despite adding inside the header “Origin: [http://localhost:3000](http://localhost:3000)”. “[http://localhost:3000/](http://localhost:3000/)” is a trusted origin inside Okta, whi is that? I tried to do a POST Request on the Okta API “v1/trustedOrigins” to add the server-side APIs as Trusted Origins, however I got this error below: ```auto { "errorCode": "E0000022", "errorSummary": "The endpoint does not support the provided HTTP method", "errorLink": "E0000022", "errorId": "oaeUwwz9JQ8ROeIkfvqSoYOHQ", "errorCauses": [] }: ``` Can you also check if my logic is correct when it comes to implementing the server side APIs? I want to make sure I am on the right track in terms of logic and flow. Thank you very much for your time. ---
**Author:** ![axelkouassi](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@axelkouassi](https://devforum.okta.com/u/axelkouassi)\ **Post date:** [January 12, 2022, 10:43pm UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/18 "2022-01-12T22:43:19Z")
> [@jmussman](#): > > Back to the end of your question: do you have to enable CORS in Okta for the Grails app? Not if you are using an API token, but probably if you are using an access token (and set the “origin” in the header properly). I haven’t actually tested that I ended up using the Grails CORS 1.1.0 plugin to deal with the CORS issue. I see that the server returns some headers, based on my configuration in the config.groovy file when the React makes an api call in the Response Headers. ```auto cors.enable.logging = true // enable logging of failed requests cors.url.pattern = '/api/v1/*' cors.headers = ['Access-Control-Allow-Origin': 'http://localhost:3000', // Only allow access to that origin 'Access-Control-Allow-Headers': '*', 'Access-Control-Allow-Methods': 'GET, HEAD, TRACE, OPTIONS', ] ``` However there’s still a CORS issue because the browser doesn’t seem to get the status code 200 sent by the server. How do you make sure that the browser sees that status? I can see the status in the browser when launching the back-end app as well as from the command line “curl”, however the React front-end is having that issue that’s preventing the front end from accessing the server services, because the back-end doesn’t return status code 200, despite that I wrote some code to return that status. ```auto def index(){ def users = User?.list(max:5, sort: "username", order:"asc") response.status = 200 render(users as JSON) } ``` Is there something wrong with the code? Why isn’t the status returned back when the browser does it’s preflight check with “OPTIONS” header? Am I supposed to add the “OPTIONS” header as an additional “method” in my urlMappins.groovy file? I will read more about the documentation and see if that’s an option. I thought the Cors Plugin would have handled that. ```auto static mappings = { '/api/v1/users'(resources:'user') "/api/v1/user/$username"(controller:'user', action:"findByUsername", method: 'GET') ``` Thank you very much for your time. ---
**Author:** ![axelkouassi](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@axelkouassi](https://devforum.okta.com/u/axelkouassi)\ **Post date:** [January 16, 2022, 2:16am UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/19 "2022-01-16T02:16:33Z")
> [@jmussman](#): > > Back to the end of your question: do you have to enable CORS in Okta for the Grails app? Not if you are using an API token, but probably if you are using an access token (and set the “origin” in the header properly). I haven’t actually tested that 🙂 I was able to fix the issue using the Grails Cors 1.3.0 plugin. Thank you very much for your help. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 12, 2024, 6:07pm UTC](https://devforum.okta.com/t/how-we-can-implement-refresh-token-with-authorize-and-token-in-grails/14104/20 "2024-02-12T18:07:54Z")
Closed on February 12, 2024, 6:07pm UTC