Too frequent token refreshing

[bartdeveloper]

In my case, ionic-appauth plugin send request for new access/refresh token to Azure AD after few/over a dozen request with bearer token (and then unfortunately Azure blocking my next requests for login for some time). Maybe it is problem with usage SecureStorage? I thought app lost entry from SecureStorage oraz my config is bad.

And another related case - when I testing solution in web browser - then I getting info: token is valid (from isValid() method), but when I testing authorization on mobile device (use Pkce: true) then I always got info: token is not valid ( isValid() return false). What might be caused this problem?

It's my config for mobile:

   identity_client: 'id-from-Azure', 
    identity_server: 'https://login.microsoftonline.com/some-id-graph/', 
    redirect_url: 'APP-ID://callback',
    scopes: 'openid profile offline_access',
    usePkce: true,
    end_session_redirect_url: 'APP-ID://endSession',
    auth_extras: { 'resource' : 'api-id-from-Azure' }

[wi3land]

Hi @bartdeveloper, The ionic app auth library does the refresh when calling the getValidToken method.
It checks against the current token in the observer and calls the isValid method on that token. If its not valid it will contact the refresh endpoint. The isValid method just looks inside the current token to make sure the current date is greater than the expiry date set on the token by the server.

I would say it could be your server config setting the expiry timeout to low. One way to check this is to copy your token onto jwt.io it will convert the expiry date into a datetime and you can see if it is getting set too low.

[bartdeveloper]

Thanks @wi3land for reply. For example now I got token with that parameters:
issued_at: 1575371455,
expires_in: 3600
buffer valid default (-600).

and current time from Math.round(new Date().getTime() / 1000) is 1575371456 and... I got false from isValid() method (only on mobile device with pkce, when I use preview in web browser, then is OK, valid). And the question is WHY 😄

Condition: 1575371456 < (1575371455 + 3600) should return true.

Here is isValid method from AppAuth-JS:

isValid(buffer: number = AUTH_EXPIRY_BUFFER): boolean {
    if (this.expiresIn) {
      let now = nowInSeconds();
      return now < this.issuedAt + this.expiresIn + buffer;
    } else {
      return true;
    }
  }

I think the problem is with IS_VALID_BUFFER_KEY. Probably on mobile device plugin doesn't read value isValidBuffer from auth_extras or the default value of them is incorrect. When I written own function isValid with bigger value of buffer, then I got true.
How correctly set isValidBuffer?

[AndrWeisR]

How are you configuring your own custom AUTH_EXPIRY_BUFFER? Do you have code like:

this.authConfig.auth_extras['isValidBuffer'] = '-300';

or

auth_extras: { 'resource' : 'api-id-from-Azure', 'isValidBuffer' : '-300' }

[bartdeveloper]

@AndrWeisR it is my config for mobile:

    identity_client: 'id-from-Azure', 
    identity_server: 'https://login.microsoftonline.com/some-id-sts/', 
    redirect_url: 'APP-ID://callback',
    scopes: 'openid profile offline_access',
    usePkce: true,
    end_session_redirect_url: 'APP-ID://endSession',
    auth_extras: { 'resource' : 'api-id-from-Azure', 'isValidBuffer' : '-300'  }

I am very surprised why isValid() return true when I run app from browser and return false when I run on mobile device (with Android 9) despite according to computing should return true.

[AndrWeisR]

It might be worth checking the values in the mobile app: now, this.issuedAt, expiresIn etc. Maybe one of them has a surprising value on the mobile, different to in the browser.

[bartdeveloper]

@AndrWeisR
Data in browser:

Data in mobile:

I see only one difference -> expires_in in the browser (implicit flow) has value 3599, while in the mobile (auth code flow with pkce) has value 3600 and in console.log it's not colored blue like number.

And when I change value of buffer to 0 then my function isValid() return true:

Probably ionic-appauth ignoring my value of isValidBuffer (e.g. 0) in auth_extras because when I debug mobile app in Chrome then I see default value -600 in appauth-js isValid method:

My isValid() function in angular guard (it's only copy from appauth-js):

isValid(expiresIn, issuedAt, buffer: number = AUTH_EXPIRY_BUFFER): boolean {
      if (expiresIn) {
        let now = nowInSeconds();
        return now < issuedAt + expiresIn + buffer;
      } else {
        return true;
      }
    }

[bartdeveloper]

Guys, I found solution/bug - it is in openid/AppAuth-JS library and partly in Azure AD. Browser on my mobile (on computer not!) get expiresIn value from Azure AD as string so I have to convert it to number using Number() function and then isValid() method return true.
My pull request: openid/AppAuth-JS#132

[jeswin-roma]

Hi @bartdeveloper - I am facing an issue where the Azure Active Directory users are kicked out of the Ionic/Angular app after 24 hours (I use bearer token and not refresh token). Can you please share how you implemented the refresh token to keep the login session always active? Users wants to access the app without having to login each time. I tried looking around for plugins but couldn't find any - other than Auth Connect which needs an enterprise license. Thanks.

[mraible]

I've used refresh tokens with this library and Okta successfully. The most important thing is to include "offline_access" in your scopes.

…

On Sep 2, 2021, at 08:18, jeswin-roma ***@***.***> wrote:  Hi @bartdeveloper - I am facing an issue where the Azure Active Directory users are kicked out of the Ionic/Angular app after 24 hours (I use bearer token and not refresh token). Can you please share how you implemented the refresh token to keep the login session always active? I tried looking around for plugins but couldn't find any - other than Auth Connect which needs an enterprise license. Thanks. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.