We have some users seeing this, even though this is their only refresh attempt in surrounding couple of hours.
We use the auth0 hook without any surrounding logic or caching on our end:
const token = await useAuth0().getCredentials()
react-native-auth0 version: 5.0.1, iOS
Log id: 90020251031003016555919000000000000001223372092434150111 for one such instance
Welcome back to the Community!
Just to double check, are you passing in the proper scopes (offline_access) in the authorize request?
Do you have Refresh Token Rotation enabled for your application?
Also, what are you current Refresh Token Maximum Lifetime settings? Could it be possible that the refresh token expired?
You mentioned that you have no caching on your application and that you are only calling the Auth0 hook, meaning that there are no refresh tokens stored inside the application or web cookies, right?
Looking forward to your reply!
Kind Regards,
Nik
We are currently not passing any scope, can you give me some pointers for the offline_access you mentioned?
We have refresh token rotation enabled with a 20 second overlap. It’s not possible that the token is expired, because we have an expiry time on the order of months and this happens several times a day for the same user.
Correct, we are not caching it anywhere.
Hi again!
We are currently not passing any scope, can you give me some pointers for the offline_access you mentioned?
Whenever you start authorization for your users, do you pass in the these additional authorization parameters as such:
await authorize(
{
scope: 'openid profile email offline_access',
audience: 'YOUR_API_IDENTIFIER',
},
);
I would recommend to check inside the Auth0 Dashboard if you have the following:
Have you tried by any chance to store the token using the credentials manager to see if there are any differences in the behaviour?
Kind Regards,
Nik
Oh I see what you mean, yes, we pass offline_access in our authorize call:
```
const credentials = await authorize({
audience,
scope: “openid profile email offline_access”,
additionalParameters,
})
```
We have those settings enabled. I’m not sure what you mean by credentials manager, I prefer to just use the standard react-native hooks provided by the sdk.
Hello @johan.lindell,
Could you please tell us if this issue is happening to an isolated user or multiples users and if you are able to reproduce this on your end ?
One possibility is that the refresh token was rotated but the new refresh token was not successfully stored. This could happen if the user closes the application during the transaction, there was a network issue or something similar.
Another reason could be that you are creating multiple versions of the CredentialsManager
( this would be the default example presented in the SDK as well - const credentials = await auth0.credentialsManager.getCredentials();), like from a computed property. The use of multiple instances is mentioned in the context of iOS as a potential cause of refresh token reuse.
This KB article - Refresh Token Rotation: Automatic Reuse Detection Issue in iOS App is the most appropriate in this case, so I would recommend checking this out.
Thank you,
Remus
This happens to multiple users though we don’t have a way to reproduce.
It seems to happen mostly on Apple devices using both the react native and react SDKs from Auth 0.
I’m not exactly sure what code changes you are suggesting, we spent a significant effort ensuring we correctly access the auth0 hook on every calls following the rules of react after previous communications with auth0.
Hi again!
I am posting in regards to the most recent updates on the issue that you are experiencing and for future visibility inside the Community.
It appears that the SDK team were able to pinpoint the the issue and have opened a PR in order to tackle the unstable network. This can be viewed here.
It is currently planned to release the changes for iOS and SPA applications only whereas for Android, once the changed are ready to be pushed, you will be able to update to the latest version without making any code changes.
I will be marking this reply as a solution and if necessary, I will post a final update.
Kind Regards,
Nik
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.