Feature: Broader assumptions on failed refresh requests about react-oauth2-pkce HOT 3 CLOSED

@prabhurajshell You should not have to check for expiry, nor do a manual refresh.
The library will refresh the token in the background as long as the refresh_token is valid. When (if ever) the refresh_token expires, it will trigger the onRefreshTokenExpire-event which you can handle. Usually by doing a page refresh, triggering a new login.

from react-oauth2-pkce.

I'm gonna vote against a general 40x check at least. A 404 should not happen if the refresh token being expired, and the same applies to 403. I'll accept arguments that 401 might be ok, since technically you're no longer authenticated when this happens, but a 400 makes much more sense.

Still... we're working with a plethora of OAuth-providers, so maybe we can start with 400 and see if anyone creates issues that their providers uses 40x, and then add one by one?

from react-oauth2-pkce.

@soofstad Side question related to expiry of tokens : I don't see anything in the documentation regarding options to refresh tokens on expiry. How do we check if a token is expired/valid or renew it when required?

PS : Thank you for this simple and effective package. :)

from react-oauth2-pkce.