0

I use the [simple_oauth][1] module to authenticate the user.

I have generated the first access_token using the grant_type=password.

then I have tried to get a new access_token using my refresh_token received from first request :

POST /oauth/token

grant_type:refresh_token
refresh_token:def50200d3c74fa2e41a886a6ff1...
client_secret:l0r3m1psum

the first time I execute the request it returns the new access_token :

{
    "token_type": "Bearer",
    "expires_in": 300,
    "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJS..",
    "refresh_token": "def502002b9ce17870bc285427a6.."
}

the problem is the second time I run the same request it Doesn't works and I get 401 unauthorized with this HTML body :

{
    "error": "invalid_request",
    "error_description": "The refresh token is invalid.",
    "hint": "Token has been revoked",
    "message": "The refresh token is invalid."
}

for the second request I have used the same refresh_token(I'am sure it not expired I have set ttl to 78000 for test) :

POST /oauth/token

grant_type:refresh_token
refresh_token:def50200d3c74fa2e41a886a6ff1...
client_secret:l0r3m1psum

grant_type:refresh_token request will enable us to get new access_token as long as refresh token not expired?

but it is like getting expires after just executing a request one time , if I generate a new refresh_token using the grant_type:password in my case the grant_type:refresh_token request works fine .

but in [1]: https://www.drupal.org/project/simple_oauth

Improve this question
5
  • Please show the second request. Did you use the new access token in the second request?
    – mona lisa
    Commented Mar 21, 2023 at 23:32
  • I think this is the way refresh tokens work. You use them once.
    – mona lisa
    Commented Mar 22, 2023 at 3:15
  • As far as I know, Cliefen is correct. When you use the refresh token, it is expired, and you receive a new refresh token together with the new authorization token you requested.
    – Jaypan
    Commented Mar 22, 2023 at 3:52
  • @cilefen have added the second request to the question, and about using the refresh token once
    – Marwen Amri
    Commented Mar 22, 2023 at 9:01
  • @Jaypan but this refresh token has not expired yet , it is like it is expired directly after the first equest
    – Marwen Amri
    Commented Mar 22, 2023 at 9:03

1 Answer 1

Reset to default
1

This is working as expected. You receive a new access token and refresh token. You must use those in subsequent requests.

Improve this answer
3
  • Cliefen is correct. Your first request to /oauth/token with the refresh token returned a NEW token. You need to replace the old token with the new token for the next request. Then when that next request is made, you will receive a NEW Oauth token, and replace the last one, and then you repeat forever.
    – Jaypan
    Commented Mar 22, 2023 at 13:45
  • Actually the access token is usable during the expires_in time.
    – mona lisa
    Commented Mar 22, 2023 at 14:05
  • Good point. My post should have made it clear that the requests being referred to were only requests to the /oauth/token endpoint for grant_type=refresh_token, and not requests made to other endpoints.
    – Jaypan
    Commented Mar 22, 2023 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.