You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi.
I'm using ory/fosite as Oauth2 authenticator and access/refresh token generator for our system business APIs, using auth codes, scope offline, refresh token rotation, etc.. All worked fine until I had to add a Google Home action feature to control an IoT device.
When running the required tests to publish the google home action I got an issue related to the refresh token:
Test Refresh Token
Refresh token has been rotated.
This is not forbidden, however we do not see much benefit that rotating the refresh token can provide but the potential
problem it has. We also tried to refresh token with the old refresh token after it has been rotated.
Refresh didn't work, this means partner invalidated the old refresh token right after the rotation.
Partners shall only invalidate the old refresh token after seeing we use the new one to ensure we got it successfully.;:
expected 'FAIL' to not equal 'FAIL'
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
-
Hi.
I'm using ory/fosite as Oauth2 authenticator and access/refresh token generator for our system business APIs, using auth codes, scope offline, refresh token rotation, etc.. All worked fine until I had to add a Google Home action feature to control an IoT device.
When running the required tests to publish the google home action I got an issue related to the refresh token:
Test Refresh Token
Refresh token has been rotated.
This is not forbidden, however we do not see much benefit that rotating the refresh token can provide but the potential
problem it has. We also tried to refresh token with the old refresh token after it has been rotated.
Refresh didn't work, this means partner invalidated the old refresh token right after the rotation.
Partners shall only invalidate the old refresh token after seeing we use the new one to ensure we got it successfully.;:
expected 'FAIL' to not equal 'FAIL'
According to the google doc related to implementing an Oauth2 server (https://developers.home.google.com/cloud-to-cloud/project/authorization) there are some requirements (https://developers.home.google.com/cloud-to-cloud/project/authorization#exchange_refresh_tokens_for_access_tokens, https://developers.google.com/identity/account-linking#token_handling)
I can't figure out how to configure ory/fosite to suit their needs since with the refresh token rotation the old access and refresh tokens are revoked and calling the refresh using the same refresh token twice results in the invalidation of all the access/refresh token family.
Does anyone solved this out somehow?
I run the google action tests using version 0.40.2.
Thanks,
A.
Beta Was this translation helpful? Give feedback.
All reactions