Refresh Token missing about oauth2orize HOT 8 OPEN

@benrolfe I got mine working, you simply have to generate a refresh token during the exchange and pass the optional refreshToken parameter to the exchange callback. Below is an example of the callback. Hope that helps!

server.exchange(oauth2orize.exchange.code((client, code, redirectUri, done) => {
    // Check the auth code
    // Destory auth code
    // Create access token
    // create refresh token
    ...
        return done(null, token, refreshToken, { expires: 3600});
    ...

}));
                               

from oauth2orize.

I would like some information on this as well, the documentation states that refresh token support is bundled yet shows no examples. Thanks in advance!

from oauth2orize.

Are you able to help @jaredhanson?

from oauth2orize.

@jesseg34 Thanks for the tip, that's exactly what I needed.

On a related note, when you exchange a refresh token for a new access token, should I expect to receive a new refresh token?

This is what I get back after the exchange:

access_token: "eyJhbGmtOIEJkIdMtX3L5tsEA.............dTLpGy4n8hefXae5cYoiFvIXg"
expires_in: 3153600000
token_type: "Bearer"

from oauth2orize.

This is more of an implementation decision however the short answer is no. Refresh tokens are meant to be long-lived and normally do not expire.

Some more reference:

• https://stackoverflow.com/questions/8953983/do-google-refresh-tokens-expire
• https://alexbilbie.com/guide-to-oauth-2-grants/

from oauth2orize.

Does this logic work with the 'basic' strategy? Or is there a need to define your own custom strategy?

from oauth2orize.

Be aware that for security reasons, some flows do not allow refresh tokens such as implicit grant type flow: https://tools.ietf.org/html/rfc6749#section-9

from oauth2orize.

@benrolfe I got mine working, you simply have to generate a refresh token during the exchange and pass the optional refreshToken parameter to the exchange callback. Below is an example of the callback. Hope that helps!

server.exchange(oauth2orize.exchange.code((client, code, redirectUri, done) => {
    // Check the auth code
    // Destory auth code
    // Create access token
    // create refresh token
    ...
        return done(null, token, refreshToken, { expires: 3600});
    ...

}));
                               

It worked

from oauth2orize.