令牌已过期或撤销

Question

I am using google auth to send emails via google api. It works fine initially but then I am getting this error after an hour or so.

{
    "error" : "invalid_grant",
    "error_description" : "Token has been expired or revoked."
}

I am using the Google.Apis.Auth.AspNetCore3 .NET nudget package. I have this code on Startup.cs file:

services.AddAuthentication(options =>
      {
        options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
      })
      .AddCookie().AddGoogleOpenIdConnect(options =>
      {
        var secrets = GoogleClientSecrets.FromFile("google_client_secret.json").Secrets;
        options.Scope.Add(GmailService.Scope.GmailSend);
        options.Scope.Add(GmailService.Scope.GmailSettingsSharing);
        options.Scope.Add(GmailService.Scope.GmailSettingsBasic);
        options.ClientId = secrets.ClientId;
        options.ClientSecret = secrets.ClientSecret;
        options.CallbackPath = new PathString("/signin-google");
      });

I am using this code to authenticate:

var authenticationProperties = new AuthenticationProperties()
        {
          RedirectUri = redirectUri
        };

return Challenge(authenticationProperties, GoogleOpenIdConnectDefaults.AuthenticationScheme);

and then the code below for sending the email using google service:

AuthenticateResult authResult = await HttpContext.AuthenticateAsync();
string accessToken = authResult.Properties.GetTokenValue(OpenIdConnectParameterNames.AccessToken);
string refreshToken = authResult.Properties.GetTokenValue(OpenIdConnectParameterNames.RefreshToken);

var secrets = GoogleClientSecrets.FromFile("google_client_secret.json").Secrets;
string googleAuthTokenPath = "GoogleAuthToken";

var token = new TokenResponse { AccessToken = accessToken, RefreshToken = refreshToken };
var credentials = new UserCredential(new GoogleAuthorizationCodeFlow(
new GoogleAuthorizationCodeFlow.Initializer
{
 ClientSecrets = secrets,
 DataStore = new FileDataStore(googleAuthTokenPath, true),
}),
"user",
token
);

var service = new GmailService(new BaseClientService.Initializer()
{
 HttpClientInitializer = credentials,
 ApplicationName = "Some app",
});

Event when I try to use credentials.RefreshTokenAsync , I still get the same error. It happens after an hour or so. Don't know what's the issue here.

Answer 1

My understanding is that refreshing is done for you (given the code in your example).

Check access_type=offline is specified so that a refresh token is provided. Log/debug whether there is a valid string value for the refresh token when you get it from the properties.

I don't know how to specify the access type in configuration of the Google Open ID Connect middleware, sorry. It's probably simple, I just didn't look it up.