Why identityserver3 did not return refresh token?

Question

My client use implicit flow Of OAuth2. After logged in successful, the identityserver3 return access token,expires,scopes and so on. But it did not return refresh token. I have set the offline_access scope in request url, AllowedScopes of client and identityServerServiceFactory, it doesn't work. However if I change to the authorizaion code flow, the identityserver3 will return refresh token.

My code is as below:

$("#btn").click(function () {
     var authorizationUrl = 'http://localhost:44300/core/connect/authorize';
     var client_id = 'MyMobileApp';
     var redirect_uri = 'http://localhost:44300/JsImplicitFlowDemo.html';
     var response_type = "token";
     var scope = "offline_access";
     var state = Date.now() + "" + Math.random();
     localStorage["state"] = state;

     var url = authorizationUrl + "?" +
          "client_id=" + encodeURI(client_id) + "&" +
          "redirect_uri=" + encodeURI(redirect_uri) + "&" +
          "response_type=" + encodeURI(response_type) + "&" +
          "scope=" + encodeURI(scope) + "&" +
          "state=" + encodeURI(state);

           window.location = url;
});

Could you help me please, thank you!

Farwell_Liu Farwell_Liu · Accepted Answer · 2016-10-27T10:12:40

I have read the implicit flow spec of OAuth2 just now. The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens)

Why identityserver3 did not return refresh token?

1 Answers