question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. ItĀ collects links to all the places you might be looking at while hunting down a tough bug.

And, if youā€™re still stuck at the end, weā€™re happy to hop on a call to see how we can help out.

Refresh token automatically on HTTP 401 or 403 response?

See original GitHub issue

Iā€™m using the API (v1.0.10) in the following way:

    var oauth2Client = new OAuth2(getGoogleCredentials().clientId, getGoogleCredentials().secret);
    oauth2Client.setCredentials({
      access_token: user.services.google.accessToken,
      refresh_token: user.services.google.refreshToken
    });
    calendar.events.list({
        calendarId: 'primary',
        auth: oauth2Client
      }, ...);

When my token is expired I get an HTTP 401 back from the server. However, Iā€™d expect the library to automatically refresh my token and make the request again. It doesnā€™t.

I figured out that a workaround is to add the expiry_date when calling setCredentials, e.g.

oauth2Client.setCredentials({
      access_token: user.services.google.accessToken,
      refresh_token: user.services.google.refreshToken,
      expiry_date: user.services.google.expiresAt
    });

But this isnā€™t mentioned in the docs. Iā€™d expect expiry_date to be optional and the API to auto refresh the token.

Issue Analytics

  • State:closed
  • Created 9 years ago
  • Comments:25 (7 by maintainers)

github_iconTop GitHub Comments

1reaction
bdrazencommented, Jun 10, 2018

Cheers for the snappy response! šŸ»

1reaction
JustinBeckwithcommented, Jun 10, 2018

Greetings! The event based approach is new, and was added after this post was originally answered šŸ˜ƒ . Both ways are fine honestly. The nice thing about using the event is that you get notified not only when the refresh_token changes, but also when the access_token is refreshed. The tokens returned here should return the expiry_date.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Correct HTTP code for authentication token expiry - 401 or 403?
The 401 (Unauthorized) status code indicates that the request has not been applied because it lacks valid authentication credentials for theĀ ...
Read more >
Forbidden (403), Unauthorized (401), or What Else? - Auth0
403 Forbidden is the status code to return when a client has valid credentials but not enough privileges to perform an action on...
Read more >
Handle 403 Error as 401 (auto refresh acess token) [Oauth 2 ...
Im doing a GoToWebinar integration to get some data thatĀ“s not included in the native app and i need.My auth is working for...
Read more >
Using Axios interceptors for refreshing your API token.
The response interceptor checks to see if the API returned a 403 status due to an expired token. If so, it calls a...
Read more >
When to Return a 401 vs 403 HTTP Response
Authentication can fail for a lot of reasons: bad password, an expired API token, something in the application changed, etc. For example, a...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found