Search code examples
reactjsgoogle-apigoogle-drive-apigoogle-oauthwebserver

How to keep on refreshing access_token so that the user is always signed in using oauth 2.0?


I have a react web application. There is an option to upload files from google drive. Once I sign in to google drive using google oauth 2.0 drive, I always want to be logged in to google drive. I have kept the refresh_token, access_token and expirationdate generated after login to drive in the database. The accesstoken expiry is 1 hour but I want to keep on refreshing indefinitely. I thought of creating a scheduler which keeps on refreshing the access_token but I am not sure how to do it because google is the one doing the refreshing. Is there a way to do this or any approach?


Solution

  • Issue:

    Assuming that you are using implicit (client-side) OAuth 2.0, this grant type doesn't support refresh tokens. Instead, users should re-authorize when the access token expires.

    That's because this kind of authorization flow:

    is designed for applications that access APIs only while the user is present at the application.

    If you want to refresh an expired access token without prompting the user for permission, you should look into explicit (server-side) OAuth 2.0 (see Refreshing an access token (offline access)):

    Server-side web applications, installed applications, and devices all obtain refresh tokens during the authorization process. Refresh tokens are not typically used in client-side (JavaScript) web applications.

    Reference: