Skip to content

JWT access token is converted to 'secure random' key after refreshing tokens

Hi, Seems after refreshing tokens (/token) JWT access token is converted to random key

Flow: I use enable :oauth_jwt, :oidc config and when i generate new tokens via /token with grant type 'authorization_code', it returns:

{
    "access_token": "some token in JWT format",
    "token_type": "bearer",
    "expires_in": 300,
    "refresh_token": "some random generated key",
    "id_token": "some token in JWT format" 
}

But when access token is expired i try to refresh it POST /token with grant type 'refresh_token', it returns:

{
    "access_token": "some random generated key",
    "token_type": "bearer",
    "expires_in": 300,
    "refresh_token": "some random generated key",
    "id_token": "some token in JWT format"
}

My expectation that access token will be refreshed like JWT, I can't understand, is it issue or feature:)

Maybe I found the place where it happened: File: lib/rodauth/features/oauth_base.rb

    def create_oauth_token_from_token(oauth_token, update_params)
      redirect_response_error("invalid_grant") unless token_from_application?(oauth_token, oauth_application)

      rescue_from_uniqueness_error do
        oauth_tokens_ds = db[oauth_tokens_table]
        token = oauth_unique_id_generator  <----- HERE, It generates SecureRandom string

        if oauth_tokens_token_hash_column
          update_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
        else
          update_params[oauth_tokens_token_column] = token
        end
...

Could you please support me:) Thank you.

Edited by Dmitriy But