Users getting logged out with "Unsuccessful Refresh Token exchange, reused refresh token detected"
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 38/100
- Issue 类型
- 缺陷
- 描述清晰度
- 需要澄清
- 活跃度
- 活跃
- 技术栈
- react, typescript
调研方向
从 auth0-react Sample-01 应用开始，检查报告中描述的 Auth0Provider 配置和 getAccessTokenSilently 的使用。跟踪启用 cacheLocation="localstorage" 和 useRefreshTokens 时的刷新令牌处理，并在可能的情况下复现间歇性交换失败。完成的标准是确定因重复使用令牌而登出的原因，并在报告涉及的环境中验证受影响的行为。
由索引模型根据 Issue 内容生成。
描述
Checklist
- The issue can be reproduced in the auth0-react sample app (or N/A).
- I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
- I have looked into the API documentation and have not found a suitable solution or answer.
- I have searched the issues and have not found a suitable solution or answer.
- I have searched the Auth0 Community forums and have not found a suitable solution or answer.
- I agree to the terms within the Auth0 Code of Conduct.
Description
Our usage of Auth0 is pretty simple. After the user has been logged in we just attach the access token to network calls and verify them server side.
const useApi = (): Api => {
const { getAccessTokenSilently } = useAuth0()
const backend = axios.create({ baseURL: apiUri, timeout: 10000 })
backend.interceptors.request.use(
async config => {
const accessToken = await getAccessTokenSilently()
config.headers["Authorization"] = `Bearer ${accessToken}`
return config
},
async error => {}
)
}
We have gotten user reports that they get error in title. Our understanding is that this error is unrecoverable so we log the user out and force them to re-authenticate. We have a couple of thousand weekly users and this happens to maybe 2% of them.
One log id as an example:
90020251109193144192993000000000000001223372093304300940
Our top level provider:
<Auth0Provider
key={`${domain}-${clientId}-${audience}`} // This forces remount when values change
domain={domain}
clientId={clientId}
authorizationParams={{
redirect_uri: getFrontEndHost(),
audience: audience,
}}
cacheLocation={"localstorage"}
onRedirectCallback={onAuth0Redirect}
useRefreshTokens={true}
>
<AppWithTheme />
</Auth0Provider>
Reproduction
Seems to happen randomly, a few times a week for affected users. Mostly on iOS and MacOS devices but we've also seen it happen on Windows machines.
Additional context
A similar issue happens when we use the react native version, but only for iOS devices. We allow overlap for expiring refresh tokens (120 seconds). Our refresh token are set to last one year, and we're currently seeing this multiple times a week for users.
auth0-react version
2.8.0
React version
19.1.0
Which browsers have you tested in?
Chrome, Safari
- 主要语言
- TypeScript
- 星标
- 991
- 派生
- 294
- 平均合并
- 11 小时 1 分钟
- 30 天内合并 PR
- 51
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
auth0/auth0-react 的其他 Issue
-
enhancement
难度 4/5 3-5 天 新手友好度 35/100
auth0/auth0-react#562 · 14 条评论 ·
维护者通常 1 天内回复
查看 auth0/auth0-react 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
难度 1/5 1-3 小时 新手友好度 84/100
-
难度 2/5 1-3 小时 新手友好度 83/100
keptinventory/kept#336 ·
维护者通常 1 天内回复
-
good first issue
难度 2/5 1-3 小时 新手友好度 84/100
-
hemi-earn
难度 2/5 1-3 小时 新手友好度 72/100
vetro-protocol/vetro-monorepo#1013 ·
维护者通常 1 天内回复