JWT access token is converted to 'secure random' key after refreshing tokens
Hi, Seems after refreshing tokens (/token) JWT access token is converted to random key
Flow:
I use enable :oauth_jwt, :oidc
config and when i generate new tokens via /token
with grant type 'authorization_code', it returns:
{
"access_token": "some token in JWT format",
"token_type": "bearer",
"expires_in": 300,
"refresh_token": "some random generated key",
"id_token": "some token in JWT format"
}
But when access token is expired i try to refresh it POST /token with grant type 'refresh_token', it returns:
{
"access_token": "some random generated key",
"token_type": "bearer",
"expires_in": 300,
"refresh_token": "some random generated key",
"id_token": "some token in JWT format"
}
My expectation that access token will be refreshed like JWT, I can't understand, is it issue or feature:)
Maybe I found the place where it happened: File: lib/rodauth/features/oauth_base.rb
def create_oauth_token_from_token(oauth_token, update_params)
redirect_response_error("invalid_grant") unless token_from_application?(oauth_token, oauth_application)
rescue_from_uniqueness_error do
oauth_tokens_ds = db[oauth_tokens_table]
token = oauth_unique_id_generator <----- HERE, It generates SecureRandom string
if oauth_tokens_token_hash_column
update_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
else
update_params[oauth_tokens_token_column] = token
end
...
Could you please support me:) Thank you.
Edited by Dmitriy But