How to request a new access token with additional extraTokenParameters after the user has already authenticated?

[jessgoldq4]

Hi there. Question. I want to retrieve a new access token for a user with a new set of custom claims after they have already logged in and retrieved their initial access token.

Is there something built into the package to enable us to force a new access token to be generated? Or do I need to hit our IDP's refresh token endpoints directly?

What's the best way to accomplish this with react-oauth2-pkce?

Thanks in advance

[soofstad]

Hi,
There is no feature to call the token endpoint at will.
Also, if you change the claim, the IDP should deny the request for a new access token using the old refresh token.
That means you would need to login from scratch, with the new claim.

This flow you are describing definitely seems a bit out of the ordinary. I could try to help out if you provide some more information :)

[soofstad]

That's good to hear. Let me know how it goes 🙂

[abdullahmonoar]

Hi @soofstad, thanks for the quick turn around on the update. I think it mostly does what we want, but not entirely in the experience that we're looking for.

So we have a feature in our app, where you click on a user to impersonate, and we want to refresh the token in the background. If we call login, this does a full page refresh and not really what we want. Is there a way to expose a method so that we can do this refresh in the background with additional params?

We've got a bit of a deadline for this change, end of May. We're happy to support in any way we can, do you think it would be possible to prioritize this functionality?

for reference, we're trying to replicate this behaviour: https://github.com/auth0/auth0-spa-js/blob/8653181d23ecea17729da203253d4fa4d17d8ef6/src/Auth0Client.ts#L643

[soofstad]

I see. It would be a useful feature. Most of the infrastructure is already there. What is lacking is the makingAuthRequestInIFrame-function. That would create cause cross-origin issues for most setups, that you would then need to fix.

To develop and test this properly would take some time. I can not promise I will get around to it anytime soon. I've created an issue for it (#147). If any of you are able to contribute with this that would be much appreciated.

[abdullahmonoar]

Okay very nice, I think you're definitely more versed with Authentication. Wondering if one solution could be creating a function like so in AuthContext and what security concerns this poses?

  function loginSilently(tokenParams: TPrimitiveRecord = {}) {
    fetchTokens({...config, extraTokenParameters: tokenParams })
      .then((tokens: TTokenResponse) => {
        clearStorage()
        handleTokenResponse(tokens)
      })
      .catch((error: Error) => {
        console.error(error)
        setError(error.message)
      })
  }

[soofstad]

That function only fetches tokens using a code or a refresh token. That can happen with a post request.
What you need is a redirect, similar to https://github.com/soofstad/react-oauth2-pkce/blob/main/src/authentication.ts#L15, but in an iframe or popup