Nextjs-auth0: invalid_grant (Unknown or invalid refresh token.)

[RyanPayso13]

Description

I am getting the following error:

invalid_grant (Unknown or invalid refresh token.)

When there is a certain period of inactivity on the site. So I log in, go away and do something else and when I come back to the site I am redirected to my _error page which has thrown a 500 error status from the call to my /api/token api page in nextjs.

I looked through the library and cannot see this error message anywhere so I assume it has come from Auth0 which leads me to believe that It is a configuration issue.

Here is what I have set up in the configuration:

{
    clientId: process.env.AUTH0_CLIENT_ID as string,
    clientSecret: process.env.AUTH0_CLIENT_SECRET,
    scope: 'openid email offline_access',
    audience: process.env.AUTH0_API_AUDIENCE,
    domain: process.env.AUTH0_DOMAIN as string,
    redirectUri: `${baseURL}/api/callback/`,
    postLogoutRedirectUri: `${baseURL}/`,
    session: {
      cookieSecret: process.env.SESSION_COOKIE_SECRET as string,
      cookieLifetime: 60 * 60 * 8,
      cookiePath: '/',
      cookieSameSite: 'lax',
      storeIdToken: true,
      storeRefreshToken: true,
      storeAccessToken: true,
    },
  }

offline_access scope and storeRefreshToken is necessary to enable refresh tokens I believe so they are added here.

On the Auth0 settings I have:

• enabled the Refresh Token grant type
• refresh token expiration (absolute & Inactivity) are both enabled with Absolute Lifetime set to 36000 and Inactivity Lifetime set to 3600
• API Access Settings have enabled Allow Offline Access and Token Settings as follows Token Expiration 86400, Token Expiration for Browser Flows 7200

I am not rotating refresh tokens at all.

All of the above seems sane but after the inactivity period I still get the 500 response error mentioned. Can anyone see anything that I have missed as to why an error is being thrown after the inactivity period rather than the access token being refreshed?

Environment

Please provide the following:

• 0.16.0

[adamjmcgrath]

Hey @RyanPayso13

refresh token expiration (absolute & Inactivity) are both enabled with Absolute Lifetime set to 36000 and Inactivity Lifetime set to 3600

1 hr seems a bit short for an inactivity lifetime, if you set it to this I would exect you to get an invalid_grant error after not using your refresh token for 1hr. Since your access token expiration is 1hr, I would expect this to happen all the time.

[RyanPayso13]

@adamjmcgrath thanks for the quick reply.

Having spent the day looking through the docs this is not an issue with the lib but how we handle the refresh token expiration timeout.

We will extend the timeout and handle the expiration in the /api/token api page.

[adamjmcgrath]

Sounds good - thanks @RyanPayso13

[bchurlinov]

@RyanPayso13 Hey Ryan, I have exactly the same issue. Can you please elaborate a bit more on how did you resolve the issue? Thanks a lot in advance