CODEWITHSUNDEEP
c#asp.net-coreoauthoauth-2.0identityserver4
Linda Lawton - DaImTo
Linda Lawton - DaImTo

Reputation: 116868

Identity server 4 handling Expired or revoked refresh tokens

I am working with an Identity server 4 system. We are using the exact code from the MvcHybridAutomaticRefresh sample

The issue is with this code here. AutomaticTokenManagementCookieEvents.cs#L73

var response = await _service.RefreshTokenAsync(refreshToken.Value);
    if (response.IsError)
       {
       _logger.LogWarning("Error refreshing token: {error}", response.Error);
       return;
       }

Currently if a refesh token was revoked by the admins, or the refresh token has expired ( we do not have sliding refresh tokens enabled) Then the application will crash. I would expect it to reroute the user to the login screen.

I am i missing something in this sample that it cant handle that?

I have also posted this as a question on the issue forum #3599

current attempt

is to add The following rather where it detects the error

await context.HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);

which i had hoped would log the user out. This just hangs and never goes anywhere. Its not even logging you out of the server.

Current Solution

The only thing i can find currently that remotely works is to add a catch in the api call. This is not ideal as in our actual application we have a lot of api calls this would mean making a lot of changes to our application. Isnt there a way to force a login directly from the middle wear itself?

[Authorize]
    public async Task<IActionResult> CallApi()
    {
        try
        {
            var token = await HttpContext.GetTokenAsync("access_token");

            var client = _httpClientFactory.CreateClient();
            client.SetBearerToken(token);

            var response = await client.GetStringAsync(Constants.SampleApi + "identity");
            ViewBag.Json = JArray.Parse(response).ToString();

            return View();
        }
        catch (Exception)
        {
            return new SignOutResult(new[] { "Cookies", "oidc" });
        }
    }

Upvotes: 0

Views: 803

Answers (1)

d_f
d_f

Reputation: 4859

You can add just one row to force the middleware to perform the challenge again:

if (response.IsError)
{
    _logger.LogWarning("Error refreshing token: {error}", response.Error);
    context.RejectPrincipal();
    return;
}

Upvotes: 1

Related Questions