I’m using the Okta React library and the refresh flow is completely broken. The autoRenew
feature is also buggy and the library itself recommends to use getAccessTokenOrRefresh()
for each request, disabling active refresh.
So I do this, I have setup my Authorization Server Access Policy to expire access tokens every 5 minutes for faster debugging. Refresh tokens are configured to expire every 10 minutes, or 8 if not used (which I don’t know what is the point of, what would I use a refresh token other than refreshing? Doesn’t that make the lifetime of the refresh token 8 minutes all the times?)
Back to the app, things work normally, until 4 minutes and 30 seconds, the Expired event is emmited because Okta React has it as a default to expire 30 seconds earlier. If I try to make a request then, getAccessTokenOrRefresh
will start a refresh request to the /token
endpoint and get the token as expected, using the refresh_token
grant and everything works fine. But if 5 minutes and 1 second pass, the refresh request responds with 400 (Refresh token is expired or invalid). So I assume the Okta App configuration or the Access Policy Rule are not applying correctly to the refresh token lifetime.
I also logged all other events. after expiration, if I try to access the tokens, the ID token gets removed and immediately added back (I saw those events logged for the ID Token)