Using expire OAuth 2.0 access token expires the refresh token?

[benji78]

I am experiencing a mysterious issue with refreshing JIRA (and Atlassian, generally) OAuth 2.0 access tokens. My flow is this (and I have verified that this code works):

1.  Move user through the 3LO authentication flow. Upon completion both the access token and refresh token are correctly stored.

2. Calls to endpoints work (i.e.: access token is valid) for 1 hour (per design).

3. Once the 1 hour expiry time is up, the next call fails (as expected) at which time a refresh token is requested. This is what fails.

At step (3) I get:

1. A `401` response from the initial call (due to expired token)

2. A `403` from the refresh token call, with the error being "invalid refresh token".

However...

If I call the refresh token endpoint _before_ the 1 hour expiry it works (every time).

And so, does the use of an expired access token invalidate the refresh token? I don't see any good reason why it would and, if I understand correctly, other OAuth 2.0 implementations don't do this.

Could anyone shed any light on this?

Cheers,

Ben

[Prince Nyeche]

In your authorization URL did you include offline_access value in the scope parameter? That part is required for refreshing tokens. The reason for the error is stated in the docs, so if you have not done the above, that would explain the invalid refresh token.

[benji78]

Thanks for your reply @Prince Nyeche .

Indeed I am using that scope. For reference, here is my full request path:

https://auth.atlassian.com/authorize?audience=api.atlassian.com&client_id=####&scope=read:jira-user read:jira-work offline_access&redirect_uri=####&response_type=code&prompt=consent

Does that look right?

[Prince Nyeche]

That seems right but why do you make a call to the initial flow again after the 1 hr expiry in step(3)? What I did in my own instance, since I store the refresh token after the first initial call, I just make a call to the refresh token endpoint with the data from the stored first call. The only time I will initialise the entire OAuth flow is if the first token isn't saved or is empty. If not, the first call is never initialised to get the refresh token.

Added comment:

This is a public repo to my own implementation. See if it helps.