Cannot turn off refresh tokens while using nextjs-auth0

jaredgalanis1 · December 12, 2020, 8:23pm

We are using the nextjs-auth0 library and our user sessions are never invalidated and we cannot seem to turn off the use of refresh tokens.

We have disabled refresh token rotation in the auth0 dashboard, but when calling tokenCache.getAccessToken() the token returned always gets refreshed even after setting the amount of time set in Refresh Token Expiration --> Absolute Lifetime.

Is there a way to turn off refresh tokens entirely? We’d like to invalidate sessions at the expiration of an access token.

Is it some property that needs to get passed at initialization of nextjs-auth0?

** UPDATE **

We have console logged inside of the library in the tokenCache.getAccessToken method and session.refreshToken is always undefined, so it appears that it is not an issue with a refresh token.

It appears that a new access token is provided after expiration (value returned by getAccessToken changes after the session expiration period lapses and the expiration time stamp is updated). Is this expected behavior? We would have expected the access token to have expired and a new one not be issued.

In other words, we would expect to hit this line, but we never do.

github.com

auth0/nextjs-auth0/blob/33bd853474689751860ead749430cf0d84913269/src/tokens/session-token-cache.ts#L69


      
              );
            }
          }
          
          
// Check if the token has expired.
          // There is an edge case where we might have some clock skew where our code assumes the token is still valid.
          // Adding a skew of 1 minute to compensate.
          if (!session.refreshToken && session.accessTokenExpiresAt * 1000 - 60000 < Date.now()) {
            throw new AccessTokenError(
              'access_token_expired',
              'The access token expired and a refresh token is not available. The user will need to sign in again.'
            );
          }
          
          
// Check if the token has expired.
          // There is an edge case where we might have some clock skew where our code assumes the token is still valid.
          // Adding a skew of 1 minute to compensate.
          if (
            (session.refreshToken && session.accessTokenExpiresAt * 1000 - 60000 < Date.now()) ||
            (session.refreshToken && accessTokenRequest && accessTokenRequest.refresh)
          ) {

FURTHER UPDATE

We added an audience to the auth0 client initialization and this seems to have solved the issue with the issuance of the access token. We are now receiving an access token and it expires after the set time period.