Retry token renewal after network failure?

Questions OAuth/OIDC
1

Hi again.

I’ve got a single-page app where access tokens expire after 5 mins. I’m using OktaAuth from okta-auth-js (version 6.3.0) with the autoRenew option and I’m listening for the expired, renewed and error events from the tokenManager - if there’s an error I sign the user out, and I just log the other events to the browser console for debugging (I’m using Firefox).

I left the app running overnight and I can see that the tokens were getting renewed every 4 1/2 mins as expected. But then around 00:15 the request to the /token endpoint failed:

token renew failure
token renew failure734×876 15.2 KB

Firefox flags this as a CORS error, but the Mozilla docs say this:

Blockquote
The HTTP request which makes use of CORS failed because the HTTP connection failed at either the network or protocol level. The error is not directly related to CORS, but is a fundamental network error of some kind.
Blockquote

My Okta console shows no sign in its log of having received this last request (all the others are there) so I can only assume that there was a temporary network failure.

So my question is: how best to work around this situation? Can I get OktaAuth to retry after errors, or can I try renewing the token myself?

Cheers,
Geoff.

2

Hi @geoff! Right now we do not have any retry logic and we treat all errors as permanent. You could implement your own approach to this e.g. setup a “passive” approach to token renewal, where renew is only attempted when a user is trying to access something. This can be done by disabling “autoRenew” and “autoRemove” in the services config section: okta-auth-js/README.md at master · okta/okta-auth-js · GitHub.

3

Thanks for the info. I’m happy to do the token renewal myself (say, via a timeout loop with an interval of 5 mins) but I’d still need a way to tell a “real” error (when renewal has been refused) from a transient, retryable network error.

I’ve noticed that for some errors the tokenManager.on("error") event returns a nice structure with members like errorCode and description, but for others (like this network error) it doesn’t. Maybe that’s the way to tell the difference?

Geoff.