Can't get around Intelligent Tracking Prevention with Refresh Tokens

[stephanie.chamblee]

Hi @mayhew3,

This can sometimes happen if the audience and/or scope is not included in the AuthModule.forRoot() or if you are requesting an access token for a different audience at a later point. Could this be the case for your app?

Also, are you using cacheLocation: "localstorage"?

https://community.auth0.com/t/why-is-authentication-lost-after-refreshing-my-single-page-application/56276

Trying the new Refresh Token Rotation in a React SPA. Are 3rd party cookies supposed to be required?

Hi @onpaws, Thanks for trying out the new feature! In that default configuration with refresh tokens turned on, you will be storing the refresh token in memory. So when you come to the app fresh or refresh the page, you won’t have a refresh token. In any event that you don’t have a refresh token, the SDK falls back to the legacy iframe method to try and get you an access token and a refresh token based on your existing session. This unfortunately has all the pitfalls of requiring 3rd-party coo…