Refresh token request doesn't include custom query parameters by default.

[Hawxy]

Describe the problem

If you happen to have refresh tokens enabled and come back after token expiry the initial request will be missing the custom query parameters you specified within your client initialization, thereby breaking any rule that relies on them.

What was the expected behavior?

Silent auth requests involving refresh tokens should probably include any custom parameters you've specified by default. This includes both manually calling getTokenSilently and the initial checkSession call invoked by createAuth0Client.

Reproduction

1. Enable refresh tokens, localstorage cache, and set the token lifetime to 90 seconds (for testing).
2. Add a custom query parameter to the createAuth0Client options, say tenant_id: 'test'
3. Perform a hard refresh so the authorize call is made and your refresh token cache populated.
4. Wait a bit
5. Do a page refresh.
6. Watch as your rule sets itself on fire when it tries to access the tenant_id field as it isn't being sent.

Workaround

I'm aware I can work around this by calling checkSession manually and passing in the custom options, but I'd argue this is a poor development experience, as you'd expect the custom query params set on the Auth0Client to be sent to your rule regardless of if refresh tokens are enabled or not.

Environment

• Version of auth0-spa-js used: 1.10
• Which framework are you using, if applicable (Angular, React, etc): Vue.js

[adamjmcgrath]

Hi @Hawxy - yep, it should pick up those default parameters like the iframe method does.

Please continue to use the workaround you described for now and we'll schedule some work in to fix this.