tamis0583
tamis058313mo ago

refresh token and client secret

I'm trying to implement token refresh in python + fastapi + request-oauthlib using the PCKE flow as followed:
python
@router.get("/refresh-token")
async def refresh_token(request: Request, response: Response):

# Log to console
logger.info("Attempting to refresh access token.")

# Get the configuration
config = get_config()

print("TRACE 00001")

# Get the session refresh token
refresh_token = await request.state.session.get('refresh_token')

print("TRACE 00002")

# Check err
if not refresh_token:
logger.error("No refresh token available in session.")
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Refresh token not found.")

print("TRACE 00003")

# Create oauth client
oauth2 = OAuth2Session(
client_id=config['client_id'],
scope=config['scope']
)

print("TRACE 00004")

# Refresh the token
try:
new_token = oauth2.refresh_token(
token_url=config['oid_config']['token_endpoint'],
refresh_token=refresh_token,
client_id=config['client_id']
)
except Exception as e:
logger.error(f"Failed to refresh token: {str(e)}")
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=str(e))

print("TRACE 00005")

# Store new refresh token
await request.state.session.put('refresh_token', new_token.get('refresh_token', refresh_token))

print("TRACE 00006")

# Store new access token
await request.state.session.put('access_token', new_token['access_token'])

print("TRACE 00007")

original_url = await request.state.session.get('original_url', '/dead')
response = RedirectResponse(url=original_url)
response.set_cookie(key="access_token", value=new_token['access_token'], httponly=True)

return response
python
@router.get("/refresh-token")
async def refresh_token(request: Request, response: Response):

# Log to console
logger.info("Attempting to refresh access token.")

# Get the configuration
config = get_config()

print("TRACE 00001")

# Get the session refresh token
refresh_token = await request.state.session.get('refresh_token')

print("TRACE 00002")

# Check err
if not refresh_token:
logger.error("No refresh token available in session.")
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Refresh token not found.")

print("TRACE 00003")

# Create oauth client
oauth2 = OAuth2Session(
client_id=config['client_id'],
scope=config['scope']
)

print("TRACE 00004")

# Refresh the token
try:
new_token = oauth2.refresh_token(
token_url=config['oid_config']['token_endpoint'],
refresh_token=refresh_token,
client_id=config['client_id']
)
except Exception as e:
logger.error(f"Failed to refresh token: {str(e)}")
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=str(e))

print("TRACE 00005")

# Store new refresh token
await request.state.session.put('refresh_token', new_token.get('refresh_token', refresh_token))

print("TRACE 00006")

# Store new access token
await request.state.session.put('access_token', new_token['access_token'])

print("TRACE 00007")

original_url = await request.state.session.get('original_url', '/dead')
response = RedirectResponse(url=original_url)
response.set_cookie(key="access_token", value=new_token['access_token'], httponly=True)

return response
But I get he error Failed to refresh token: (invalid_client) empty client secret but no client secret should be needed??
2 Replies
FFO
FFO13mo ago
Hm it sounds like your client throws that error already, right?
tamis0583
tamis0583OP13mo ago
Yes and If I remove the client id from oauth2.refresh_token as so:
new_token = oauth2.refresh_token(
token_url=config['oid_config']['token_endpoint'],
refresh_token=refresh_token
)
new_token = oauth2.refresh_token(
token_url=config['oid_config']['token_endpoint'],
refresh_token=refresh_token
)
I get:
ERROR:auth:Failed to refresh token: (invalid_request) client_id or client_assertion must be provided
ERROR:auth:Failed to refresh token: (invalid_request) client_id or client_assertion must be provided
So I'm in a catch 22

Did you find this page helpful?