-
Notifications
You must be signed in to change notification settings - Fork 1k
Open
Labels
authIssues and PRs related to authorizationIssues and PRs related to authorizationbugSomething isn't workingSomething isn't workingneeds-triageNeeds to be triaged by maintainersNeeds to be triaged by maintainersp1-highHigh priority - should be addressed soonHigh priority - should be addressed soon
Description
Describe the bug
Token refresh flow doesn't refresh the token, but simply runs the normal auth flow again from the start.
To Reproduce
Steps to reproduce the behavior:
- Authenticate using either "Guided OAuth Flow" or "Quick OAuth Flow"
- Then request token refresh either using "Guided Token Refresh" or "Quick Refresh".
Expected behavior
- Not to have a Client Registration step, since token refresh should use the existing client id.
- Use auth server's token refresh functionality, instead of registration/authentication flow. Especially,
grant_typeshould berefresh_token.
Logs
Initiating token refresh clearly shows
grant_type=authorization_code
in the POST request's form data. Instead it should be grant_type=refresh_token
Additional context
Related to #608, but the difference is that there it is about not refreshing the token after a timeout, but here it is about the manual "Guided Token Refresh"/"Quick Refresh" flow.
huv1k, wizardist, karandeep-johar, shubhamd and salmonsteak1
Metadata
Metadata
Assignees
Labels
authIssues and PRs related to authorizationIssues and PRs related to authorizationbugSomething isn't workingSomething isn't workingneeds-triageNeeds to be triaged by maintainersNeeds to be triaged by maintainersp1-highHigh priority - should be addressed soonHigh priority - should be addressed soon