0

I'm working to implement Google Actions, and I've came into this problem.

After successful authentication (Account Linking with OAuth) everything works fine, all of the intents (SYNC,QUERY ec...) are working. During the test fase I've restarted the server that handles the authentication and the intents (which also holds user sessions our side) so the user session that Google has became invalid (in existent) at our side, so when a new intent is incoming with the access token (that we could say has been expired on my side) the intent fails for authentication error. And here comes the issue:

I've tried to respond with authExpired or even authFailure as described here: https://developers.google.com/actions/smarthome/develop/process-intents#error-responses

but it simply does not work. It seems like until the token does not expire on Google side, I'm not able to make it expire "intentionally". So to make it work we are forced to unlink the action or wait the expiration time than everything works as expected.

It this an intended behavior?

I hope my question was clear, if not I'm here to add more details.

Thanks,

devunwired
  • 62,780
  • 12
  • 127
  • 139
IOOOTABertalan
  • 1
  • Could you shown the code that you used and describe which part fails? – MaartenDev Aug 22 '19 at 10:27
  • It's hard to post some code, at our backend it's not a failure, we are responding correctly (i hope so) with an `authExpired`, but it has no effect, even after the response google do not request a new access token. On the Google Cloud Platform this log appears: `Found json master errorCode authExpired` – IOOOTABertalan Aug 22 '19 at 10:56

1 Answers1

0

It seems like until the token does not expire on Google side, I'm not able to make it expire "intentionally".

You are correct that this is the current behavior. Generally speaking, we expect developers to use short-lived access tokens where the expiration time is meaningful in requiring those tokens to be granted again.

Developers wishing to enable users to intentionally revoke access (outside of unlinking their account) should invalidate the refresh token provided to Google and continue to return an authFailure when those credentials are presented.

devunwired
  • 62,780
  • 12
  • 127
  • 139