Search code examples
phpoauth-2.0oauth2client

Dealing with OAuth 2.0 Token expiration at the Consumer


I have a client application that use the oauth2 with authorization grant type resource owner password credential. I write a curl http request to obtain the access token when user provide her credential, but how to request another access token when the first one expired. I read that it's good to estimate the validity of the access token. I found this client library but I don't think it will solve my problem related to requesting a new access token once it expire or even when the refresh token expired too.

Can anyone point me to the right direction how to implement this or use a library for that purpose please?


Solution

  • Instead of checking token expiration for every resource request, you can handle token expiration error and perform a Refresh Token request to get a new access token.

    oAuth server should normally mention invalid_grant in its response when access token is invalid, expired, or revoked. Refer here. You should check with your oAuth server what response it provides exactly when a token is expired.

    Some libraries does include this feature but I do not find for the library you mentioned. I used Retrofit as java client and it has this. You might want to request this feature for the library you mentioned.

    If a refresh token is expired, the oAuth authorization flow should start over again.