Refresh token

[hamidh2]

Hello,
After sign in always, the refresh token value is undefined! how can I solve this?

  this.socialAuthService
      .signIn(GoogleLoginProvider.PROVIDER_ID)
      .then((singInResult) => {
        this.socialAuthService.refreshAuthToken(GoogleLoginProvider.PROVIDER_ID).then(token=>{
          console.log("refresh token",token);

[jaibatrik]

The SocialUser object that you receive in your subscriber would have the token. I don't think the Promise returned by refreshAuthToken resolves to the token.

[hamidh2]

@jaibatrik
When I'm logging the social user value it shows me three types of token which are idToken,accessToken,authToken!
How can I solve this part?

[jaibatrik]

Last I remember, the whole response from Google is made part of the SocialUser object. I think you can get any relevant information from the response you want.

Check this as well - https://developers.google.com/identity/sign-in/web/backend-auth

[havart]

Hello,
After sign in always, the refresh token value is undefined! how can I solve this?

  this.socialAuthService
      .signIn(GoogleLoginProvider.PROVIDER_ID)
      .then((singInResult) => {
        this.socialAuthService.refreshAuthToken(GoogleLoginProvider.PROVIDER_ID).then(token=>{
          console.log("refresh token",token);

As I understood that is not the refresh token, that is method to refresh your access token

[havart]

I have same problem.
I need a refresh token to transfer it to the server. How can I get it?

[hamidh2]

I need it for passing to server as well

[havart]

Yes, me to.

[bernardogontijo]

any solutions found? @havart @hamidh2

[chrissteiner]

Hi all,
a few months ago I spent a lot of time in research this "problem".
the "problem" is actually a design decision of google not to provide refresh tokens anymore. There was a final date, when they cancelled the functionality (I think it was something with may 2023 -> so in the past from now)

google acts now as a identity provider only. this means they are providing a token which lasts one hour, which tells you that the user is valid. After the hour you cannot get a refresh token, the only way is to re-login the user.

in my case I take the google token on login, verify it against my server, create a completely new pair of access token and refresh token and I am responsible for refreshing the access token. every following request is made with my own created token.
at first I was frustrated about that, because I wanted somebody else to handle this refreshing stuff, but since I needed to support more id providers than google I am really happy about this, because there is only one place I hat to expand the functionality.

to sum up: google acts as a identity provider and does not care about sessions. this need to be done by you.

[gpalasti]

The refreshToken calls google.accounts.id.revoke....that simply revokes access from the app. How does that should refresh the access token?

[jdgabriel]

@gpalasti Any solution for this?

@chrissteiner do you have an example code, how do you solve this problem in the backend?

[chrissteiner]

hi @jdgabriel,

this obviously depends on your backend. in my case I used nodeJs and I am pretty happy with it. ( I can say that because I installed a container which measures my endpoints (it's called Akita and is free) and the endpoint has a p90 of 4,6ms (of course without the time the network takes to request/respond))

this is a good description how to implement this:
https://medium.com/@techsuneel99/jwt-authentication-in-nodejs-refresh-jwt-with-cookie-based-token-37348ff685bf

I did quite the same like in the tutorial above with some tweaks here and there. for example I wanted to know how many devices one user uses and so on

If the tutorial is not enough for you you can contact me directly the I can show or send you some code snippets.

Regards Chris