Refresh token automatically on HTTP 401 or 403 response?
See original GitHub issueIām using the API (v1.0.10) in the following way:
var oauth2Client = new OAuth2(getGoogleCredentials().clientId, getGoogleCredentials().secret);
oauth2Client.setCredentials({
access_token: user.services.google.accessToken,
refresh_token: user.services.google.refreshToken
});
calendar.events.list({
calendarId: 'primary',
auth: oauth2Client
}, ...);
When my token is expired I get an HTTP 401 back from the server. However, Iād expect the library to automatically refresh my token and make the request again. It doesnāt.
I figured out that a workaround is to add the expiry_date
when calling setCredentials, e.g.
oauth2Client.setCredentials({
access_token: user.services.google.accessToken,
refresh_token: user.services.google.refreshToken,
expiry_date: user.services.google.expiresAt
});
But this isnāt mentioned in the docs. Iād expect expiry_date
to be optional and the API to auto refresh the token.
Issue Analytics
- State:
- Created 9 years ago
- Comments:25 (7 by maintainers)
Top Results From Across the Web
Correct HTTP code for authentication token expiry - 401 or 403?
The 401 (Unauthorized) status code indicates that the request has not been applied because it lacks valid authentication credentials for theĀ ...
Read more >Forbidden (403), Unauthorized (401), or What Else? - Auth0
403 Forbidden is the status code to return when a client has valid credentials but not enough privileges to perform an action on...
Read more >Handle 403 Error as 401 (auto refresh acess token) [Oauth 2 ...
Im doing a GoToWebinar integration to get some data thatĀ“s not included in the native app and i need.My auth is working for...
Read more >Using Axios interceptors for refreshing your API token.
The response interceptor checks to see if the API returned a 403 status due to an expired token. If so, it calls a...
Read more >When to Return a 401 vs 403 HTTP Response
Authentication can fail for a lot of reasons: bad password, an expired API token, something in the application changed, etc. For example, a...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Cheers for the snappy response! š»
Greetings! The event based approach is new, and was added after this post was originally answered š . Both ways are fine honestly. The nice thing about using the event is that you get notified not only when the refresh_token changes, but also when the access_token is refreshed. The tokens returned here should return the expiry_date.