Mismatch Between Refresh Token Expiration Handling and Auth0's Absolute Expiration Policy

[kleysonfiretail]

I am currently using Auth0 with Absolute Expiration and Refresh Token Rotation. However, I noticed that the library seems to expect the refresh token's expiration time to be renewed with each use.

The library renews the expiration time of the refresh token every time I request a new refresh token. Since I am using an absolute expiration policy, the refresh token should not be renewed and should have a fixed expiration time from the initial issuance. This discrepancy causes a mismatch between when the token actually expires and when the library thinks it will expire.

Question:

Is there a way to configure the library to handle refresh tokens with a fixed expiration time from initial issuance, so it aligns with Auth0's Absolute Expiration policy? If not, are there any plans to support this behavior, or do you have any recommended workarounds?

[soofstad]

Hi @kleysonfiretail
Thank you for raising the issue.
Ideally, the Identity Provider should respond with a refresh_expires_in or similar, if it returns a refresh token. Does it? Or is it called something unconventional?

Also, if the IDP does not return a refresh_token, the library will keep the old one, and the expire time for that.

These two mechanism together should result in the behavior you expect.
If it does not, I'd like to figure out why.

And if all else fail, you do have this config param:

// Can be used if auth provider doesn't return refresh token expiration time in token response
  refreshTokenExpiresIn?: number // default: null

[kleysonfiretail]

Hi @soofstad thank you for answering me

Let me give you a little bit more context:

1. The IDP does not return the refresh_expires_in or similar, and seems to be not possible to do that

Similar issue: Need access to Absolute Expiry of refresh token in the UI
Similar issue: How to get Refresh token expiry time in response?

2. We are also using the approach called Refresh Token Rotation this means that we have a refresh_token and every time the application exchanges the refresh_token to get a new access token, a new refresh token is also returned

DOC: Refresh Token Rotation

3. We tried to use the refreshTokenExpiresIn and although it helps it does not solve our issue

[kleysonfiretail]

@soofstad I took the liberty of creating a PR with the fix for this issue

#168