Auth0.js: Can’t get google refresh token using auth0.js

[duongmanhhoang]

Describe the problem

I follow this link https://community.auth0.com/t/cant-get-google-refresh-token-using-auth0-js/11756

When i’m using login with google function, i can't get the refresh token.
This is my code:

var params = Object.assign(
  {
    overrides: {
      __tenant: config.auth0Tenant,
      __token_issuer: config.authorizationServer.issuer,
    },
    domain: config.auth0Domain,
    clientID: config.clientID,
    redirectUri: config.callbackURL,
    responseType: "code",
    scope: 'openid profile offline_access'
  },
  config.internalOptions
);

var webAuth = new auth0.WebAuth(params);

webAuth.authorize({
  connection: 'google-oauth2',
  connection_scope: 'https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/calendar.events',
  scope: 'openid profile',
  accessType: 'offline',
  approvalPrompt: 'force'
}, function(err) {
  if (err) displayError(err);
});

This is what i get from api /api/v2/users/{id}:

I check param from authorize request and still get access_type

And when i check goolge url redirect from auth0 i don't see the access_type param

[duongmanhhoang]

When i add state:'' to authorize method, it’s work. I wonder if it has any risks cause i’ve read that state is used to prevent attack?

webAuth.authorize({
  connection: 'google-oauth2',
  responseType: "code",
  state:'',
  connection_scope: 'https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/calendar.events',
  scope: 'openid profile email offline_access',
  accessType: 'offline',
  approvalPrompt: 'force'
}, function(err) {
  console.log(err);
  if (err) displayError(err);
});

[stevehobbsdev]

This sounds odd, I'm surprised it works if you set state to ''. You should not do that though as you're correct - the state parameter there is there to help prevent XSRF attacks.

In your second example you are also passing the 'offline_access' scope when compared to the example that does not work - can you confirm if you are able to omit state and have it still work?

[stevehobbsdev]

I'll close this for now. If there is still an issue here, please feel free to reply and I'll do my best to help.