Unable to use RefreshAccesToken() to get a new access token after the current one expires

[nisuraaa]

Trying to invoke the RefreshAccessToken() manually after the access token expires gives me the following error on the browser console

However attempting use the get a new token by sending the same refresh token via an API call (via Postman) to the Asgardeo Server is successful

Is this by design?

[DucTuanmdt]

I encountered the same issue. Upon investigating the asgardeo-auth-spa-sdk, I noticed that beforerefreshAccessToken is called, there is a check for authentication at the following locations:

refreshAccessToken()

public async refreshAccessToken(): Promise<BasicUserInfo | undefined> {
    await this._validateMethod();

    return this._client?.refreshAccessToken();
}

_validateMethod()

if (validateAuthentication && !(await this.isAuthenticated())) {
    return Promise.reject(
        new AsgardeoAuthException(
            "SPA-AUTH_CLIENT-VM-IV02",
            "The user is not authenticated.",
            "The user must be authenticated first."
        )
    );
}

I believe it would be beneficial to have an option to bypass this check when attempting to refresh an expired access token.

[davidtranjs]

+1 same issue here
What is the point of check access token expired before excute refresh token ?

[nisuraaa]

A workaround would be to downgrade the SDK version to 3.0.2

[davidtranjs]

@nisuraaa downgrade an major version can lead to a lot of other issues too 😢

[pavinduLakshan]

Hi @nisuraaa and @davidtranjs, I too believe that it doesn't make sense to have isAuthenticated check before refreshing the access token.

@brionmario thoughts?

[brionmario]

+1 to remove the check.
With asgardeo/asgardeo-auth-js-core#242, we are now checking the expiry time. Hence, it'll fail when the time is exceeded.

[pavinduLakshan]

+1 to remove the check. With asgardeo/asgardeo-auth-js-core#242, we are now checking the expiry time. Hence, it'll fail when the time is exceeded.

Ack. will send a fix.