Here is the TL;DR version: When adding the setting UserRefreshToken = true; to Program.cs (see the larger code snippet at the bottom of this page for more detail), what exactly is the behavior supposed to be within an AspNetCore based application? Automatic refresh does not appear to be the case in a Blazor Server application.
... okay moving back to the way TL stuff...
Posted similar question/comments on a closed issue for the auth0-aspnetcore-authentication sdk focusing on the follow:
The refresh token does not automatically refresh correctly when using
UseRefreshTokens = true.
This issue has been long closed after the reporter submitted as PR and it was accepted and merged (April 2022).
However, the token’s lack of being refreshed is still my experiences in the context of a Blazor Server application. I am leaning heavily into this is a “I’m doing it wrong” and/or “I misunderstand how this works” rather than this is a bug that needs to be fixed within the Auth0-AspNetCore-Authentication sdk.
Let me add context, I have tried to simplify what I am doing by using the Blazor Sample App, and still no refreshing of tokens occurs.
Maybe my expectations are wrong… Using the sample app, and with the Auth0 Tenant Application settings, I am setting my application Id Token Expiration to a low value, say 60 seconds, and the Refresh Token Expiration to similar value, the token’s never refresh. I see the same JWT and refresh token after the expiration date on the /Profile page (edited to show all Id, Access, and Refresh tokens). I would expect that while using the app, it would automatically refresh the token at some point, and if I’m idle, I would expect the app to force me to reauthenticate if I try to access the site, or navigate around, beyond those expiration times.
I have also setup an API in Auth0 to be able to add in an Audience in the Program.cs setup, and to set a shorter Access Token as I wondered if somehow the Access Token’s expiration time would come into play. That seems to have no affect, other the providing another expiry time in a token.
I have noticed, that once I surpass the Maximum Refresh Token Lifetime as set in Auth0, a hard refresh of the Profile page in the sample app continues to give me the original ID and Access tokens, but now the refresh token is blank…
I am assuming, at this point, that I am misunderstanding what the SDK is supposed to do when adding the line options.UseRefreshTokens = true; to the Program.cs setup. This blog post also seems to indicate that the line should provide some sort of automation of the refresh process. I and thinking what needs to occur is an integration of the Auth0.AuthenticationApi SDK and manually setup the token refresh if there is activity and the token is nearing expiration. If that is the case, then it seems I should reduce dependencies and roll a more custom implementation with the Authentication API for login, logout, and token management.
Anyway, what is this line supposed to actually do within the Blazor Server Sample App, or a Blazor Server app in general? Perhaps the lack of a more dedicated .net core based API does not initialize the automated code within this sdk?
...
builder.Services.AddAuth0WebAppAuthentication(options =>
{
options.Domain = builder.Configuration["Auth0:Domain"];
options.ClientId = builder.Configuration["Auth0:ClientId"];
options.ClientSecret = builder.Configuration["Auth0:ClientSecret"];
options.Scope = "openid profile email";
}).WithAccessToken(options =>
{
options.Audience = builder.Configuration["Auth0:Domain"];
options.UseRefreshTokens = true; <--- This is supposed to do what, beyond giving me a refresh token?
});