Refresh Token being exchanged when access token refresh is required

BrendaParker — Fri, 15 Nov 2019 23:41:06 GMT

I've been troubleshooting an issue with OAuth token refresh issues in our app that started around the time we updated to 100.6. The issue is manifesting as users needing to re-login every app launch.

Our app is using the OAuthAuthorizationCode grant type so we can retrieve a refresh token.

It appears that the runtime is making an "exchange_refresh_token" request instead of a standard "refresh_token" request when an access token has expired. We haven't seen this behaviour prior to 100.6. We have been caching the refresh token so our users would not need to login on every app restart, but with this change to "exchange_refresh_token" we no longer have a valid refresh token cached if the user is using an app longer then 30 minutes (access token length). I cannot discover a way to detect when the refresh token is change. The credentials object does have a PropertyChanged event, but this is not invoked when the refresh token changes, only when the access token changes.

This is a major breaking change for our app and I'd like to understand why the runtime is making an "exchange_token_refresh" request. Was this introduced in 100.6? If it was, was it to solve a specific issue or improve security?

Would someone be able to point me in the direction of how to detect when the refresh token is updated by the runtime?

Re: Refresh Token being exchanged when access token refresh is required

MichaelBranscomb — Sat, 16 Nov 2019 01:19:14 GMT

Brenda,

We're currently investigating this issue. I'll update this thread as soon as i have more information.

Regards

Mike

Re: Refresh Token being exchanged when access token refresh is required

MichaelBranscomb — Mon, 18 Nov 2019 18:12:04 GMT

Brenda,

Please email me on mbranscomb@esri.com. I would like to arrange for you to test a preview of 100.7.

Regards

Mike

topic Re: Refresh Token being exchanged when access token refresh is required in .NET Maps SDK Questions

Refresh Token being exchanged when access token refresh is required

Re: Refresh Token being exchanged when access token refresh is required

Re: Refresh Token being exchanged when access token refresh is required