CODEWITHSUNDEEP
react-nativeoauthspotify
Sam Leurs
Sam Leurs

Reputation: 2000

best practices for refreshing access tokens automatically

I'm building a react native app which uses the spotify web api. I'm using the authorization code flow to authorize a user. First I get a authorization code which can be used to obtain an access token and a refresh token. Everything works!

The problem is: an access token is only valid for a limited amount of time. That's where the refresh token comes in. I understand this concept, but I'm breaking my head about how to implement this.

Let's say a users opens the app, requests an access token and uses this for some time. Then, the user closes the app. After 15 minutes, the users opens the app again. The access token has now expired, so I need to request a new access token.

I've come op with several "solutions". Can someone point me to the correct solution?

Solution 1: Every time the user opens the app, I request a new access token and use this. Problem: when the user uses the app longer than the valid time of the access token, I won't work anymore.

Solution 2: I use the access token that's stored in the secure storage on every request. When a request comes back with 'access token invalid' (I don't know the exact error code but you guys know what I mean), I request a new access token with the stored refresh token, and then I send the previous command again (with the new access token). But my question here is: can I use some kind of "wrapper function" which checks the response of the request, and if the response is "access token invalid", it automatically requests a new access token and runs the previous request again.

Upvotes: 0

Views: 1863

Answers (2)

RoguePlanetoid
RoguePlanetoid

Reputation: 4576

I agree that Solution 2 is the best, each time you do a request you can check to see if the Access Token has expired, and if it has then you can request a new Access Token using the Refresh Token as you mentioned and then make your request, in my own project I do this in a FormatRequestHeadersAsync method which calls a CheckAndRenewTokenAsync method where I perform the following check, here shown in C#:

if(AccessToken?.Refresh != null && (AccessToken.Expiration < DateTime.UtcNow))
{
    AccessToken = await GetRefreshTokenAsync(
        AccessToken.Refresh, 
        AccessToken.TokenType, 
        cancellationToken);
}

You can store the Access Token and the Refresh Token and then use something similar to this before you make each request to the API this will refresh your token and then you can store the new Access Token and the existing Refresh Token.

Upvotes: 1

mortezashojaei
mortezashojaei

Reputation: 452

I think certainly correct solution is solution 2,and i think its clear enough.

and for using solution 2 you need somthing like wrapper function,yes its intelligently.

so you should use interceptor:

what is interceptor ?

You can intercept requests or responses before they are handled by then or catch.

in link below there is a good example of implementing refresh token in axios interceptor:

https://gist.github.com/Godofbrowser/bf118322301af3fc334437c683887c5f

Upvotes: 1

Related Questions