Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
Handling of failed federated token refresh due to network error
See original GitHub issueDescribe the bug
If federated token refresh fails due to a network error, auth resets requiring the user to manually sign in again. Since token refreshing hasn’t failed due to rejection by the identity provider the refresh token may still be valid and can still be used once internet access is restored.
I’m using Auth0 as my federated auth provider.
To Reproduce Steps to reproduce the behavior:
I perform the following in a React Native app running in the iOS simulator.
- Set token expiry to 60 seconds in Auth0 console
- Authenticate in the app
- Disconnect from the internet (turn off wifi on mac running simulator)
- Wait 60+ seconds
- Open the app. Token refresh will be attempted but fail due to lack of internet access.
- Reconnect internet
From this point on the API client calls reject with "Missing Authentication Token". In the scenario described here token refreshing has failed because of a network problem, not because my identity provider (auth0) as rejected the refresh request. I feel this type of error should be treated differently from a “identity provided responded and refused to refresh the token” type error.
Expected behavior
If token refreshing is not possible because of a network error the API client shouldn’t clear/reset the current federated sign in. This is particularly important in React Native as network access could be intermittent.
The documentation for handling federated auth needs a lot of work and should better explain how the API client behaves if token refreshing has failed.
Issue Analytics
- State:
- Created 5 years ago
- Reactions:1
- Comments:14 (2 by maintainers)
Top Results From Across the Web
Top Related Medium Post
Top Related StackOverflow Question
Troubleshoot Live Code
Top Related Reddit Thread
Top Related Hackernoon Post
Top Related Tweet
Top Related Dev.to Post
Top Related Hashnode Post
@powerful23 once the app launches my initial components triggers various API requests to API Gateway using the API client provided by Amplify. I don’t call
Auth.currentCredentials(). I am working on the assumption that Amplify just works and knows how to deal with intermittent network access.As described above I think there needs to be a better way of dealing with the case where the
refreshHandlersfail because of lack of internet access.@usmansbk No it’s an ongoing issue