Oauth2 built-in refresh token

[robsontenorio]

@pi0 Another one :)

Automatically refresh the "token" if it expires, because some Oauth providers has a short token TTL. It just intercepts axios requests, check for token expiration and try to refresh it.

Solves #148

[jonasgrosch]

@robsontenorio Can we get this functionality for local scheme, too?

[robsontenorio]

@jonasgrosch Sorry, this is intended for Oauth2 Scheme. For LOCAL Scheme, it would be very similar.

[ishitatsuyuki]

There seems to be some mistake on conformance with the OAuth spec.

Also, would you mind adding support of expiring access tokens obtained with the implicit flow (token grant)?

[ishitatsuyuki]

Please do not rely on access token being a JWT, but instead use the expires_in response returned along with access_token.

[ishitatsuyuki]

Please do not try to decode the refresh token. A refresh token is normally not a JWT, and it's the case of Auth0.

[ishitatsuyuki]

Please use async-await and when the refresh fails, please log the user out.

[pi0]

I think this is safe to return a promise.

[ishitatsuyuki]

Please use (and wait for) a shared Promise instead of a boolean flag.

[j-evs]

Refresh token is a much needed feature. So either this or #208 would be super awesome to have!
@pi0 @ishitatsuyuki 🙏🙏🙏

[robsontenorio]

Closing in favor of #208

[HotspurHN]

any documentation of that feature? my backend returns

{
    jwtToken: {
        { refreshToken: "somevalue", accessToken: "somevalue", expiresIn: "somevalue" }
    },
    response: "Success"
}

how to handle with that refreshToken here?

[robsontenorio]

It was not approved/merged, just closed. See #208

[pi0]

@robsontenorio sorry for the late review. This will be hopefully shipped with #325.

[robsontenorio]

@pi0 #325 is about LOCAL SCHEME. Will we have auto refresh token for OAUTH SCHEME?

[pi0]

@robsontenorio We may extract shared functionalities and share them between oauth and local.

[MathiasCiarlo]

@pi0 Could we do this and include it in 4.6.0? Or do you think it's too much work to get it done in time?

[pi0]

@MathiasCiarlo We need some refactors but don't want to block shipping other fixes for refresh support. Let's see what happens but if not included in 4.6, 4.7 or 5.0 will be worked right after that.