Hi,
our App uses a refresh token which is valid for multiple years. After updating to v7 the refresh token is invalid; exception:
ID token is required but missing. System.Exception Auth0.AuthenticationApi.Tokens.IdTokenValidationException
For us it’s not an option to logout the user and trigger a re-login.
I have tried multiple things to get the refresh token from v6 working in v7, but it didn’t work.
So my question is: How would an upgrade strategy for the refresh token look like?
Current v6 Code:
public async Task<AccessToken> GetAccessTokenAsync(string refreshtoken)
{
var accessToken = new AccessToken();
try
{
var client = CreateAuthClient();
var token = await client.GetTokenAsync(new RefreshTokenRequest()
{
Audience = _options.CustomerApp.Audience,
ClientId = _options.CustomerApp.ClientId,
ClientSecret = _options.CustomerApp.ClientSecret,
RefreshToken = refreshtoken,
});
accessToken.Token = token.AccessToken;
accessToken.ExpiryDate = DateTime.Now.AddSeconds(token.ExpiresIn - 60);
return accessToken;
}
catch (ApiException ex)
{
if (ex.ApiError.Error == "invalid_grant")
{
return accessToken;
}
throw;
}
}
public async Task<AccessTokenResponse> AuthCustomerAsync(string phone, string code, CancellationToken cancelationToken)
{
var client = CreateAuthClient();
var token = await client.GetTokenAsync(new ResourceOwnerTokenRequest
{
Username = GenerateEmail(phone),
Password = GeneratePassword(code),
ClientId = _options.CustomerApp.ClientId,
ClientSecret = _options.CustomerApp.ClientSecret,
Audience = _options.CustomerApp.Audience,
Scope = "offline_access",
}).ConfigureAwait(false);
return token;
}