oauth_expiry cookie provides incorrect information when using refresh_token

[nenb]

ALL software version info

Python 3.9.18
[GCC 12.2.0] on linux
>>> import panel
>>> panel.__version__
'1.3.8'

Probably not specific to panel version though.

Description of expected behavior and the observed behavior

I am using the generic OAuth handler. I am also using the refresh token functionality.

The issue I face is that after the access_token has been refreshed, the oauth_expiry cookie appears to provide incorrect information (it still provides information relevant to the original access_token).

It's quite possible that I am doing something incorrect, and this is not in fact a bug. I had a quick look at the code to try and understand what was going on.

It appears that the oauth_expiry cookie is set in a single location inside the _on_auth function. It also appears that this function is not entered when handling a refresh_token. This suggests to me that this might actually be a bug ie the cookie is not updated. If I have misunderstood, I will try and share a MRE that should hopefully resolve the issue one way or another.

Complete, minimal, self-contained example code that reproduces the issue

Not included.

• I may be interested in making a pull request to address this -> perhaps as simple as removing the early return?