访问令牌过期时使用刷新令牌

Question

I'm using OAuth in .Net-Core 2.1 to Login to Coinbase, I've configured my authenticaton like so:

services.AddAuthentication(COOKIE_AUTH)
    .AddCookie(options => options.ExpireTimeSpan = TimeSpan.FromMinutes(60))
    .AddCoinbase(options => {
        options.SendLimitAmount = 1;
        options.SendLimitCurrency = "USD";
        options.SendLimitPeriod = SendLimitPeriod.day;
        options.ClientId = Configuration["Coinbase:ClientId"];
        options.ClientSecret = Configuration["Coinbase:ClientSecret"];
        COINBASE_SCOPES.ForEach(scope => options.Scope.Add(scope));
        options.SaveTokens = true;
        options.ClaimActions.MapJsonKey("urn:coinbase:avatar", "avatar_url");
    });

Using Postman I see that I'm getting an access token and a refresh token. My token expires within two hours and never refreshes.

I know I can manually refresh the token, but I would expected this to be build into .net some where

Is there a way to refresh my token built into .net?

Answer 1

This doesn't make sense since the client is responsible for sending a valid token in order to expect the request to be authorized. When clients typically send tokens , they typically do so in a header. That header only contains a single access token, not a refresh token. Instead the refresh token is persisted at the client and used to get an access token that IS valid. Then it can make a different request and expect a different outcome. The flow is important.