0

I am successfully using mod_auth_openidc to authenticate my website and get an access_token. I can use the access_token to authenticate my server-side code to a third-party resource hosted elsewhere as the logged-in user.

If the access token expires, I need to refresh it, and mod_auth_openidc seems to require me to make a redirect call to a specific url to do so. If the page I'm in is a GET request, that's fine. The page notices the token has expired, and the redirect comes back to the same page. But if it's a POST, PUT or DELETE request, the eventual refresh is still a GET.

So unless I write some really dirty code to stash the original page and its full details, I seem to be stuck.

By contrast, I can easily make a server-side call to refresh the token, without involving the module, but then the module doesn't know the token has been updated and the updated token will be lost.

The particular use case is one in which I present a form to the user, ask them to fill it in, and send it off. The resulting post data is used to call the third-party API. But if the user spends too long filling in the form, the POST call has an expired access token and can't refresh it.

Is there a way round this, or will I need to revert to using a language-specific library to do all my openid and oauth stuff?

Hans Z.
  • 50,496
  • 12
  • 102
  • 115
Gary Bilkus
  • 23
  • 4

1 Answers1

0

You should be able to have your server side code not redirect the user's browser to the module's handler URL, but actually perform a direct backchannel call to it to refresh the access token. You will have to pickup and present the session cookie to be able to make that call though.

Hans Z.
  • 50,496
  • 12
  • 102
  • 115
  • Thanks but I think that's suggesting the same thing as in my original question above when I say: "By contrast, I can easily make a server-side call to refresh the token, without involving the module, but then the module doesn't know the token has been updated and the updated token will be lost". – Gary Bilkus Jun 21 '19 at 19:20
  • no, do not call the token endpoint on the AS, call the handler endpoint on the module, just like you would do in a redirect – Hans Z. Jun 21 '19 at 19:29
  • If I do that, how do I get the updated access token without leaving the current request/response and losing my post data? – Gary Bilkus Jun 25 '19 at 11:56