将协程运行块与身份验证器一起使用以处理来自 retrofit 的 401 响应

Question

I am trying to use the Authenticator to handle 401 response. What I have done is

fun provideAccessTokenAuthenticator(
    mainApiServiceHolder: MainApiServiceHolder,
    preferences: SharedPreferences
) = object : Authenticator {
    override fun authenticate(route: Route?, response: Response): Request? {
        val accessToken = preferences.getString(ACCESS_TOKEN, null)
        if (!isRequestWithAccessToken(response) || accessToken == null) {
            return null
        }
        synchronized(this) {
            val newAccessToken = preferences.getString(ACCESS_TOKEN, null)!!
            // Access token is refreshed in another thread.
            if (accessToken != newAccessToken) {
                return newRequestWithAccessToken(response.request, newAccessToken)
            }

            // Need to refresh an access token
            val refreshTokenResponse = runBlocking {
                Log.d("zzzzzzzzzz", "refresh token is running")
                mainApiServiceHolder.mainApiService?.refreshToken(
                    "refresh_token",
                    preferences.getString(REFRESH_TOKEN, null)!!,
                    AuthRepository.CLIENT_ID,
                    AuthRepository.CLIENT_SECRET
                )
            }
            Log.d("zzzzzzzzzz", refreshTokenResponse?.body()?.access_token!!)
            return if (refreshTokenResponse?.isSuccessful!!) {
                Log.d("zzzzzzzzzz", "refresh token is successful")
                newRequestWithAccessToken(
                    response.request,
                    refreshTokenResponse.body()?.access_token!!
                )
            } else {
                Log.d("zzzzzzzzzz", "refresh token is unsuccessful")
                response.request.newBuilder().header("Content-Type", "application/json").build()
            }
        }
    }

Now, it gets called when there is a 401 response. The refresh token call is also fired (from Log). However, it never gets the result in the refreshTokenResponse and nothing happens after that. I think its a wrong way of using runBlock. The api is

@FormUrlEncoded
@POST("/api/auth/token/")
suspend fun refreshToken(
    @Field("grant_type") grant_type: String,
    @Field("refresh_token") refresh_token: String,
    @Field("client_id") client_id: String,
    @Field("client_secret") client_secret: String
): Response<LoginResponse>

Any help would be really appreciated. Thanks

Answer 1

In the Retrofit API, consider replacing your async runBlocking{} suspend fun with a synchronous Call . I had the most luck avoiding the use of coroutines inside the Authenticator.

I was having the same problem. The token request went straight into a black hole. The app froze. The request was never seen again. No error, no nothing.

But everywhere else in the app, the suspend fun came back just fine. From ViewModels, from WorkManager, it worked every time. But from the Authenticator, never. What was wrong with the Authenticator? What was special about the Authenticator that made it act this way?

Then I replaced the runBlocking{} coroutine with a straightforward Call . This time, the request came back and the token arrived without a fuss.

The way I got the API to work looked like this:

@FormUrlEncoded
@POST("token")
fun refreshTokenSync(
    @Field("refresh_token") refreshToken: String,
): Call<RefreshMyTokenResponse>

Then, in the Authenticator:

 val call = API.refreshTokenSync(refreshToken)
 val response = call.execute().body()

I hope this helps someone else who ran into the same issue. You may receive a warning from Android Studio that this is an inappropriate blocking call. Ignore it.

Answer 2

• Refresh token only once for multiple requests
• Log out user if refreshToken failed
• Log out if user gets an error after first refreshing
• Queue all requests while token is being refreshed

https://github.com/hoc081098/Refresh-Token-Sample/blob/master/app/src/main/java/com/hoc081098/refreshtokensample/data/remote/interceptor/AuthInterceptor.kt

class AuthInterceptor @Inject constructor(
  private val userLocalSource: UserLocalSource,
  private val apiService: Provider<ApiService>,
) : Interceptor {
  private val mutex = Mutex()

  override fun intercept(chain: Interceptor.Chain): Response {
    val req = chain.request().also { Timber.d("[1] $it") }

    if (NO_AUTH in req.headers.values(CUSTOM_HEADER)) {
      return chain.proceedWithToken(req, null)
    }

    val token =
      runBlocking { userLocalSource.user().first() }?.token.also { Timber.d("[2] $req $it") }
    val res = chain.proceedWithToken(req, token)

    if (res.code != HTTP_UNAUTHORIZED || token == null) {
      return res
    }

    Timber.d("[3] $req")

    val newToken: String? = runBlocking {
      mutex.withLock {
        val user =
          userLocalSource.user().first().also { Timber.d("[4] $req $it") }
        val maybeUpdatedToken = user?.token

        when {
          user == null || maybeUpdatedToken == null -> null.also { Timber.d("[5-1] $req") } // already logged out!
          maybeUpdatedToken != token -> maybeUpdatedToken.also { Timber.d("[5-2] $req") } // refreshed by another request
          else -> {
            Timber.d("[5-3] $req")

            val refreshTokenRes =
              apiService.get().refreshToken(RefreshTokenBody(user.refreshToken, user.username))
                .also {
                  Timber.d("[6] $req $it")
                }

            val code = refreshTokenRes.code()
            if (code == HTTP_OK) {
              refreshTokenRes.body()?.token?.also {
                Timber.d("[7-1] $req")
                userLocalSource.save(
                  user.toBuilder()
                    .setToken(it)
                    .build()
                )
              }
            } else if (code == HTTP_UNAUTHORIZED) {
              Timber.d("[7-2] $req")
              userLocalSource.save(null)
              null
            } else {
              Timber.d("[7-3] $req")
              null
            }
          }
        }
      }
    }

    return if (newToken !== null) chain.proceedWithToken(req, newToken) else res
  }

  private fun Interceptor.Chain.proceedWithToken(req: Request, token: String?): Response =
    req.newBuilder()
      .apply {
        if (token !== null) {
          addHeader("Authorization", "Bearer $token")
        }
      }
      .removeHeader(CUSTOM_HEADER)
      .build()
      .let(::proceed)
}