-
-
Notifications
You must be signed in to change notification settings - Fork 4.7k
Description
Somehow, OAuth2 refresh tokens seem to expire. It's probably fine if they would in the long run, but this is happening within a few hours.
Steps to reproduce
- Authenticate an OAuth client and upgrade the authorization code in order to obtain access token and refresh token
- Wait for a couple of hours (6 p.m. to 9 a.m. seems to be sufficient)
- Try to obtain a new access token using the refresh token
Expected behaviour
Access tokens expire after an hour. In contrast, refresh tokens should be valid for a while; let's say for a week? I am happy to discuss this, though...
Actual behaviour
First of all, I changed OauthApiController.php and enumerated the invalid_request responses, i.e., the first occurrence is invalid_request1, the second is invalid_request2, and the third is invalid_request3.
The response of /index.php/apps/oauth2/api/v1/token is a 400 with the following content:
{
"error": "invalid_request3"
}Subsequent requests with the same refresh token result in invalid_request1. This implies that, the first time we end up here:
| } catch (InvalidTokenException $e) { |
Whereas, subsequently, we end up here:
| } catch (AccessTokenNotFoundException $e) { |
Using mitmproxy, I was able to intercept this request:
Server configuration
Operating system: Ubuntu 16.04.5 LTS
Web server: Apache/2.4.18 (Ubuntu)
Database: Postgres 9.5.14
PHP version: 7.0.32-0ubuntu0.16.04.1
Nextcloud version: 14.0.3.0
Updated from an older Nextcloud/ownCloud or fresh install: updated
Where did you install Nextcloud from: nextcloud.com
Are you using external storage, if yes which one: no
Are you using encryption: no
Logs
Nextcloud log (data/nextcloud.log)
Nextcloud log
{"reqId":"QZyVyb5XHzpDByur1vNi","level":2,"time":"2018-10-19T07:52:25+00:00","remoteAddr":"128.176.157.47","user":"--","app":"core","method":"POST","url":"\/nextcloud\/index.php\/apps\/oauth2\/api\/v1\/token","message":"Login failed: '<client id omitted>' (Remote IP: '128.176.157.47')","userAgent":"MoodleBot\/1.0","version":"14.0.3.0"}

