Rotating refresh token locking users out after expiry

Get Help
3

The error is being thrown from createAuth0Client. Since there is not a valid client its not possible to redirect or popup a login. The only way around this is to manually delete the token from session storage.

I tried this

try {

				this.auth0Client = await createAuth0Client({
					domain: options.domain,
					client_id: options.clientId,
					audience: options.audience,
					redirect_uri: redirectUri,
					cacheLocation: options.cacheLocation,
					useRefreshTokens: true
				});
			} catch (error) {
				console.log(JSON.stringify(error));

				this.auth0Client = await createAuth0Client({
					domain: options.domain,
					client_id: options.clientId,
					audience: options.audience,
					redirect_uri: redirectUri,
					cacheLocation: options.cacheLocation,
					useRefreshTokens: false
				});
				
				this.auth0Client.loginWithRedirect();
			}

By specifying to not use refresh tokens in the failure case, it does allow me to create a client and cause a login. However this doesn’t clear out the invalid refresh token and now I’m in an infinite login prompt “invalid refresh token” loop.

The only resolution I have found is to do one of 2 things:

  1. set useRefreshTokens to false
  2. set cacheLocation to ‘memory’ instead of ‘localstorage’
1 Like