Skip to content

OAuth 2 refresh tokens expire early #11919

@Dagefoerde

Description

@Dagefoerde

Somehow, OAuth2 refresh tokens seem to expire. It's probably fine if they would in the long run, but this is happening within a few hours.

Steps to reproduce

  1. Authenticate an OAuth client and upgrade the authorization code in order to obtain access token and refresh token
  2. Wait for a couple of hours (6 p.m. to 9 a.m. seems to be sufficient)
  3. Try to obtain a new access token using the refresh token

Expected behaviour

Access tokens expire after an hour. In contrast, refresh tokens should be valid for a while; let's say for a week? I am happy to discuss this, though...

Actual behaviour

First of all, I changed OauthApiController.php and enumerated the invalid_request responses, i.e., the first occurrence is invalid_request1, the second is invalid_request2, and the third is invalid_request3.
The response of /index.php/apps/oauth2/api/v1/token is a 400 with the following content:

{
    "error": "invalid_request3"
}

Subsequent requests with the same refresh token result in invalid_request1. This implies that, the first time we end up here:

} catch (InvalidTokenException $e) {

Whereas, subsequently, we end up here:

} catch (AccessTokenNotFoundException $e) {

Using mitmproxy, I was able to intercept this request:

request

response

Server configuration

Operating system: Ubuntu 16.04.5 LTS

Web server: Apache/2.4.18 (Ubuntu)

Database: Postgres 9.5.14

PHP version: 7.0.32-0ubuntu0.16.04.1

Nextcloud version: 14.0.3.0

Updated from an older Nextcloud/ownCloud or fresh install: updated

Where did you install Nextcloud from: nextcloud.com

Are you using external storage, if yes which one: no

Are you using encryption: no

Logs

Nextcloud log (data/nextcloud.log)

Nextcloud log
{"reqId":"QZyVyb5XHzpDByur1vNi","level":2,"time":"2018-10-19T07:52:25+00:00","remoteAddr":"128.176.157.47","user":"--","app":"core","method":"POST","url":"\/nextcloud\/index.php\/apps\/oauth2\/api\/v1\/token","message":"Login failed: '<client id omitted>' (Remote IP: '128.176.157.47')","userAgent":"MoodleBot\/1.0","version":"14.0.3.0"}

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions