[SDK-1739] Recover and logout when throwing invalid_grant on Refresh Token #668
Conversation
|
|
||
| if (e.error === 'login_required') { | ||
| _self.isAuthenticated = false; | ||
| } |
There was a problem hiding this comment.
This catches the login_required in our playground, allowing us to reset the authentication state when needed based on the response from Auth0.
| e.message && | ||
| e.message.indexOf(INVALID_REFRESH_TOKEN_ERROR_MESSAGE) > -1 | ||
| ) { | ||
| return await this._getTokenFromIFrame(options); |
There was a problem hiding this comment.
This introduces an additional request in Safari where we know up front it will return login_required, while for other browsers it might still work.
I do not think the SDK is currently tracking which browsers can use iframe, nor do I think it should so I wonder what you think about this extra request.
There was a problem hiding this comment.
I think it's fine to leave it, we don't do browser detection for this elsewhere and it will work for other browsers that also block third-party cookies.
src/Auth0Client.ts
Outdated
| if ( | ||
| e.message && | ||
| e.message.indexOf(INVALID_REFRESH_TOKEN_ERROR_MESSAGE) > -1 | ||
| ) { |
There was a problem hiding this comment.
Maybe we can unify this if block with the conditional above it, rather than having two if's? Feels like we could do it with an or expression.
Description
This PR ensures the SDK can recover from being instantiated using an invalid Refresh Token.
getTokenSilentlywith RefreshTokens and the Refresh Token is expired:invalid_granterror is caught and used to fallback tologinWithIFramelogin_requirederror.References
Closes #654
#449
Testing
Checklist
master