Implementation rotating refresh tokens

y.savchenko · September 8, 2020, 5:25pm

We implement Auth0 in our project and want to use approach with rotating refresh tokens instead of sessions in cookies. We configured Auth0Provider for using refresh token and storage token in local storage.
<Auth0Provider domain={domain} clientId={clientId} redirectUri={window.location.origin} onRedirectCallback={onRedirectCallback} audience={audience} useRefreshTokens={true} cacheLocation="localstorage" >
But when browser has “Block third-party cookies” settings we have error: Login required, when trying to get token by getAccessTokenSilently() method. As I understand, it happens because browser blocked cookies. Can I implement refresh token approach without using cookies?

dan.woda · September 9, 2020, 9:21pm

Hi @y.savchenko,

If you are using the auth0-react sdk, you can utilize the useRefreshTokens option to configure refresh token rotation.

github.com

auth0/auth0-react/blob/bb8ec720d85fad347e9105a7dc36e3de9cd29a85/src/auth0-provider.tsx#L71


      
          /**
           * The value in seconds used to account for clock skew in JWT expirations.
           * Typically, this value is no more than a minute or two at maximum.
           * Defaults to 60s.
           */
          leeway?: number;
          /**
           * The location to use when storing cache data. Valid values are `memory` or `localstorage`.
           * The default setting is `memory`.
           */
          cacheLocation?: CacheLocation;
          /**
           * If true, refresh tokens are used to fetch new access tokens from the Auth0 server. If false, the legacy technique of using a hidden iframe and the `authorization_code` grant with `prompt=none` is used.
           * The default setting is `false`.
           *
           * **Note**: Use of refresh tokens must be enabled by an administrator on your Auth0 client application.
           */
          useRefreshTokens?: boolean;
          /**
           * A maximum number of seconds to wait before declaring background calls to /authorize as failed for timeout
           * Defaults to 60s.

Hope this helps!
Dan

system · September 24, 2020, 9:21pm

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
How to implement rotating refresh tokens with audience parameter in React? Help auth0 , react , refresh-token-rotate	4	9790	September 19, 2020
Secure access tokens stored in local storage using refresh tokens and getting access token only when required Help apis , application	2	1633	March 13, 2023
How refreshtoken works? where it is stored? Help jwt , auth0 , login	4	1589	November 21, 2022
Can't use getAccessTokenSilently after enabling rotating refresh token when 3rd party cookies are blocked Help cookie	3	4514	June 25, 2021
Rotating refresh token locking users out after expiry Help	5	6493	November 25, 2020

Implementation rotating refresh tokens

Related topics