Sometimes occures 'invalid_grant' error

[qkrgksqkr]

Hi, I 'am 'qkrgksqkr'
I implementing OIDC protocol by using this package.
It's very nice and good,

but, somtimes I have a error message 'invalid_grant' error message, while processing 'authrozation_code" flow,
Not always, just sometimes,

Detail step is like below.
step 1. Client did /authoize,, and redirect with 'authroizatio_code'
step 2 Client request /token with 'authorization_code'
If success, Client get access/ refresh / id token,
but sometimes Client get 'invalid_grant'

so, I retry step 2, with same 'authorization_code' then, it is always success

I can't understand why this is success.

In real system, the moment between step1 and step2 is very short. no extra time.

So I test with your sampe code. and added log message

I'll try postman runner..
Your sample code with mongo deafult option, localhost:27017 , stand alone
There are no error,

but mongo db is replaset (primary - second -second), similiar to my system
It occures error sometimes

So, the difference is mongo DB environment, standAlone and ReplicaSet.

Is is some additional config element that I need to set to use this package?..
I want to solve this problem.

thank you.

[qkrgksqkr]

My mongodb is replicast structure
So, I think it is beacuse 'write concern'?..

[qkrgksqkr]

I did some test
I set this options, SetReadPreference / SetWriteConcern /SetReadConcern
Some cases, threr is no 'invalid_grant' error
would you added feautre these 3 options??

[qkrgksqkr]

I have some addtinal question.
Why this value set "SecondaryPreferred()" ??
The default is Primary

[matthewhartstonge]

Hello!

Thank you for your wonderful debugging! That's fantastic!

Yes, we've seen this error crop up as well and I was wondering if it was down to replication lag since the redirects are very quick, just never had the capacity to investigate.

The main reason we go with secondary preferred is to try to distribute as many reads away from the primary. As soon as a write is needed to be performed the mongo driver should perform the write and any subsequent queries on the primary.

If you remove the read preference and remove the write concern does it also solve the issue? (Read preference: primary)

Personally, I've been pretty unwell this week, so I won't be able to jump on a machine for a week, but can respond as needed to questions via my phone/GH app

[qkrgksqkr]

I tested 3 case, I try 20 times below url using 'postam runner', and count error case.

-> [POST] http://localhost:3846/oauth2/auth?client_id=my-client&redirect_uri=http%3A%2F%2Flocalhost%3A3846%2Fcallback&response_type=code&scope=photos+openid+offline+email&state=some-random-state-foobar&nonce=some-random-nonce

-> This url execute /authorize and /token in a row from example source

a) ReadPrefrenece - secondary ( default)
error count / total count
5/20
3/20
0/20
8/20
0/20
3/20
2/20
5/20
2/20
5/20

b) ReadPrefrenece - primary
error count / total count
0/20
0/20
0/20
0/20
0/20
0/20
0/20
0/20
0/20
0/20

c) ReadPrefrenece - secondary and WriteConcern(Wmajority())
error count / total count
0/20
0/20
0/20
0/20
0/20
0/20
0/20
0/20
0/20
0/20

teso case b) and case c) , no error.

[qkrgksqkr]

I need to solve this problem,
so I add some feature in your source temparory
I hope you will be well!
thanky for your reply

[matthewhartstonge]

Sorry about the delay on this, version v0.31.0 has been released with the fix!

Thank you! 👍