{"action":"created","issue":{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/102","labels_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/102/labels{/name}","comments_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/102/comments","events_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/102/events","html_url":"https://github.com/simplabs/ember-simple-auth/issues/102","id":28984847,"number":102,"title":"Timed out access_token is not handled gracefully on page load","user":{"login":"dschmidt","id":448487,"avatar_url":"https://avatars.githubusercontent.com/u/448487?v=3","gravatar_id":"","url":"https://api.github.com/users/dschmidt","html_url":"https://github.com/dschmidt","followers_url":"https://api.github.com/users/dschmidt/followers","following_url":"https://api.github.com/users/dschmidt/following{/other_user}","gists_url":"https://api.github.com/users/dschmidt/gists{/gist_id}","starred_url":"https://api.github.com/users/dschmidt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dschmidt/subscriptions","organizations_url":"https://api.github.com/users/dschmidt/orgs","repos_url":"https://api.github.com/users/dschmidt/repos","events_url":"https://api.github.com/users/dschmidt/events{/privacy}","received_events_url":"https://api.github.com/users/dschmidt/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":24,"created_at":"2014-03-07T17:52:46Z","updated_at":"2015-05-21T20:41:13Z","closed_at":"2014-04-07T14:37:58Z","body":"Hey,\r\n\r\nI was wondering why my timed out `access_token` was not refreshed on page load or my session was at least invalidated (granted I'm using a custom authentication provider but it's based on the upstream OAuth2 implementation).\r\n\r\nI think the `expiresAt > now` check here \r\nhttps://github.com/simplabs/ember-simple-auth/blob/master/packages/ember-simple-auth/lib/authenticators/oauth2.js#L151\r\ndoes not make sense because according to \r\nhttp://tools.ietf.org/html/rfc6749#section-4.2.2\r\nhttp://tools.ietf.org/html/rfc6749#section-5.1\r\n`expires_in` defines the lifetime of the access_token not of the refresh_token, so it might very well be possible to request a new `access_token` even if the old one is timed out because the `refresh_token` is still valid.\r\n\r\nAfaict trying to refresh with an invalid `refresh_token` would trigger a logout anyway. \r\nIf you still don't want to refresh the `access_token` in this case, you should consider to at least invalidate the session.\r\n\r\n\r\nP.S.: A lot of people seem to use a `refresh_token_expires_in` value in their server responses to mark how long the `refresh_token` is valid. It's not part of the standard afaik tho.\r\n\r\n \r\n"},"comment":{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/comments/104414603","html_url":"https://github.com/simplabs/ember-simple-auth/issues/102#issuecomment-104414603","issue_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/102","id":104414603,"user":{"login":"marcoow","id":1510,"avatar_url":"https://avatars.githubusercontent.com/u/1510?v=3","gravatar_id":"","url":"https://api.github.com/users/marcoow","html_url":"https://github.com/marcoow","followers_url":"https://api.github.com/users/marcoow/followers","following_url":"https://api.github.com/users/marcoow/following{/other_user}","gists_url":"https://api.github.com/users/marcoow/gists{/gist_id}","starred_url":"https://api.github.com/users/marcoow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcoow/subscriptions","organizations_url":"https://api.github.com/users/marcoow/orgs","repos_url":"https://api.github.com/users/marcoow/repos","events_url":"https://api.github.com/users/marcoow/events{/privacy}","received_events_url":"https://api.github.com/users/marcoow/received_events","type":"User","site_admin":false},"created_at":"2015-05-21T20:41:13Z","updated_at":"2015-05-21T20:41:13Z","body":"Yeah, unfortunately that's a bit of a problem actually. Maybe someone comes up with a two clever idea ;)"}}