CODEWITHSUNDEEP
springoauthoauth-2.0
Pubudu Jayasanka
Pubudu Jayasanka

Reputation: 1462

Refresh token not coming with authorize endpoint in oauth2

I am trying to get refresh token when authorizing the user.

This is the url that is being used for authorization.

request

https://...../oauth2/authorize?response_type=token&client_id=test-client&scope=all&redirect_uri=https%3A%2F%2Flocalhost:7002%2F...%2Foauth

redirect url with token and etc :

https://localhost:7002/..../oauth#access_token=b3961289-713c-41c9-9341-253286cbcc52&token_type=bearer&expires_in=300&scope=all

but there isn't any refresh token with this. I tried this with token endpont and it has the refresh token like this

request

curl --data 'grant_type=password&username=....&password=...' --basic --user 'test-client:client-secret' 'https://....../oauth2/token'

response

{  
   "scope":"all",
   "access_token":"5a90edb7-5ded-451a-9d9b-d3bd879ac336",
   "token_type":"bearer",
   "expires_in":300,
   "refresh_token":"ec0c94db-5e81-4229-a815-9c2d80086995"
}

Is there anyway that I can get refresh token in authorization endpoint. ? Or can I use existing token to get refresh token ?

Upvotes: 2

Views: 587

Answers (2)

iandayman
iandayman

Reputation: 4467

You can't get a refresh token when using the Implicit grant.

I presume your application is a Single Page App? i.e. html/JavaScript running in a user's browser. This is the main use case for the Implicit grant nowadays.

If it's not a SPA (e.g. native, mobile or web application) you should be able to use a different grant type which will give you a refresh token. e.g. Authorisation Code Grant or Authorisation Code with PKCE Grant.

Upvotes: 1

Linda Lawton - DaImTo
Linda Lawton - DaImTo

Reputation: 117321

This got to long for a comment

It kind of depends upon the authentication server how it works. Some servers only return a refresh token the first time the user authenticates.

To get a Refresh Token, you must include the offline_access scope when you initiate an authentication request through the authorize endpoint.

For example, if you are using Authorization Code Grant, the authentication request would look like the following:

https://__AUTH0_NAMESPACE__/authorize?
    audience={API_AUDIENCE}&
    scope=offline_access&
    response_type=code&
    client_id=__AUTH0_CLIENT_ID__&
    redirect_uri=__AUTH0_CALLBACK__&
    state={OPAQUE_VALUE}

This is the only way to obtain a refresh token so no you cant use another token to request get a refresh token.

Implicit client

In the implicit grant flow, the client is requesting access to a resource by way of a "User Agent", aka browser with the user sitting there. So a client wants to grab something, but needs the user to enter permissions for it. If the authentication server provided a refresh token, then the client could skip asking the user for permission in the future and grant itself access forever (essentially refreshing its token whenever it wants without user permission). This is forbidden in the flow because the "untrusted" client should only have access by way of having the user enter their credentials (thus only when the resource owner allows it).

Upvotes: 1

Related Questions