How to handle expired auth tokens in Xamarin MobileServiceClient?

Question

I am using client-flow authentication in Xamarin.Forms and am trying to figure out how to handle when an authentication token expires.

My Code:

Upon initial login, the user logs in with the native Facebook SDK and I pass the access_token to MobileServiceClient to get back an authenticated user.

var user = await client.LoginAsync(MobileServiceAuthenticationProvider.Facebook, token).ConfigureAwait(false);

I then save the user's UserId and MobileServiceAuthenticationToken in local settings (using the Xam.Plugins.Settings plugin). The next time the user opens the app, I set the user from settings and skip manual login:

if (!string.IsNullOrWhiteSpace(Settings.AuthToken) && !string.IsNullOrWhiteSpace(Settings.UserId))
{
    client.CurrentUser = new MobileServiceUser(Settings.UserId);
    client.CurrentUser.MobileServiceAuthenticationToken = Settings.AuthToken;
}

My Question:

This works great. However, I know that the MobileServiceAuthenticationToken has an expiration on it. What will happen in my app when the expiration date is reached? How do I refresh the token without requiring the user to re-log-in to Facebook? I have tried the MobileServiceClient's RefreshUserAsync() method, but I get the following exception:

Microsoft.WindowsAzure.MobileServices.MobileServiceInvalidOperationException: Refresh failed with a 400 Bad Request error. The identity provider does not support refresh, or the user is not logged in with sufficient permission.

Is there a way to test this? (since the token expiration is 3 months from now.) Thanks for the help!

Client-Flow authentication doesn't allow refreshing tokens, read thishttps://auth0.com/docs/api-auth/which-oauth-flow-to-use https://www.digitalocean.com/community/tutorials/an-introduction-to-oauth-2 — Johannes, Jun 07 '18 at 06:00
@Johannes, thank you for that informative link. I didn't realize so much was going on under the hood with the Facebook SDK! So if the access token can't be refreshed, how can I prevent my users from having to log in multiple times (when the token expires)? Most apps I use only asked me to authenticate once. — NSouth, Jun 07 '18 at 14:59

score 1 · Accepted Answer · answered Jun 12 '18 at 02:19

Microsoft.WindowsAzure.MobileServices.MobileServiceInvalidOperationException: Refresh failed with a 400 Bad Request error. The identity provider does not support refresh, or the user is not logged in with sufficient permission.

Since you are using client-flow authentication, you could not use RefreshUserAsync() for refreshing the MobileServiceAuthenticationToken. Your mobile backend does not cache the related access_token and refresh_token for renewing the authentication Token.

Is there a way to test this? (since the token expiration is 3 months from now.) Thanks for the help!

AFAIK, the MobileServiceAuthenticationToken expiration is one hour by default, you could use https://jwt.io/ to decode your token and check the exp property, then use https://www.epochconverter.com/ to convert your timestamp to human date.

For your requirement, you could follow adrian hall's blog about Caching Tokens and refer to the IsTokenExpired method for decode your authenticationToken and check the exp, then manually renew the authenticationToken.

Per my understanding, there are two approaches for you to achieve your purpose:

You need to cache the facebook access_token in your mobile client side, after you manually checked the authenticationToken and found that it expired, then you could manually execute the following code for renewing the token and explicitly update your local cache.

var user = await client.LoginAsync(MobileServiceAuthenticationProvider.Facebook, token).ConfigureAwait(false);

Note: Your facebook access_token has the Expiration Date, so if your access_token expired, then you need to force the user to log into Facebook again before acquiring the new authenticationToken.

Or you could build your custom endpoint for refreshing the authenticationToken and explicitly set a long lifetime for your new authenticationToken, details you could follow this similar issue. Note: For your client-side expiration processing, you need to renew the token before your local authenticationToken is about to expire.

Thank you. I followed Adrian Hall's book and walked away with a much better understanding of how I should handle access tokens. I've also come to grips with Facebook enforcing client-flow authentication to prompt user's for consent periodically. — NSouth, Jun 12 '18 at 18:04

How to handle expired auth tokens in Xamarin MobileServiceClient?

My Code:

My Question:

1 Answers1