Request for consistent handling of OAuth refresh failures

Given the following block of code that handles the refresh of the access token:

https://github.com/coder/coder/blob/2a430ab43511501b29a029db900b84cae5e11a7b/coderd/httpmw/apikey.go#L334-L347

I propose aligning the behavior of this block with the logic implemented and described in the following block of code:

https://github.com/coder/coder/blob/2a430ab43511501b29a029db900b84cae5e11a7b/coderd/externalauth/externalauth.go#L140-L159

	// We have a refresh token, so let's try it
	token, err := oauthConfig.TokenSource(r.Context(), &oauth2.Token{
	AccessToken: link.OAuthAccessToken,
	RefreshToken: link.OAuthRefreshToken,
	Expiry: link.OAuthExpiry,
	}).Token()
	if err != nil {
	return write(http.StatusUnauthorized, codersdk.Response{
	Message: fmt.Sprintf(
	"Could not refresh expired %s token. Try re-authenticating to resolve this issue.",
	friendlyName),
	Detail: err.Error(),
	})
	}

	if err != nil {
	// TokenSource can fail for numerous reasons. If it fails because of
	// a bad refresh token, then the refresh token is invalid, and we should
	// get rid of it. Keeping it around will cause additional refresh
	// attempts that will fail and cost us api rate limits.
	if isFailedRefresh(existingToken, err) {
	dbExecErr := db.UpdateExternalAuthLinkRefreshToken(ctx, database.UpdateExternalAuthLinkRefreshTokenParams{
	OAuthRefreshToken: "", // It is better to clear the refresh token than to keep retrying.
	OAuthRefreshTokenKeyID: externalAuthLink.OAuthRefreshTokenKeyID.String,
	UpdatedAt: dbtime.Now(),
	ProviderID: externalAuthLink.ProviderID,
	UserID: externalAuthLink.UserID,
	})
	if dbExecErr != nil {
	// This error should be rare.
	return externalAuthLink, InvalidTokenError(fmt.Sprintf("refresh token failed: %q, then removing refresh token failed: %q", err.Error(), dbExecErr.Error()))
	}
	// The refresh token was cleared
	externalAuthLink.OAuthRefreshToken = ""
	}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Request for consistent handling of OAuth refresh failures #19054

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Request for consistent handling of OAuth refresh failures #19054

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.