Identity Server 3 - JavaScript Resource Owner Flow with sliding token expiration

Question

I am looking to implement sliding token expiration with a JavaScript application using the Resource Owner Flow.

Our code is similar to the "JavaScript Resource Owner Flow" project within the IdentityServer3.Samples.Clients solution.

I would like to be able to get the token once and then continue to use that token until it expires (on a sliding expiration).

In sudo code the logic is as follows...

if token is undefined then call getToken() and save the result to the token variable
Use this token variable to call an api that is protected by identity server

My issue is that if the token expiration is set to 60 seconds and I call the api once every 5 seconds, on the 13 attempt the token has expired, however I would expect the token to have been refreshed.

An example of my client config is below...

{
  "enabled": true,
  "clientId": "myClient",
  "clientSecrets": [
    {
      "description": null,
      "value": "xxxxxxxxxxx",
      "expiration": null,
      "type": "SharedSecret"
    }
  ],
  "clientName": "myClient",
  "clientUri": null,
  "logoUri": null,
  "requireConsent": true,
  "allowRememberConsent": true,
  "flow": "ResourceOwner",
  "allowClientCredentialsOnly": false,
  "redirectUris": [],
  "postLogoutRedirectUris": [],
  "logoutUri": null,
  "logoutSessionRequired": true,
  "requireSignOutPrompt": false,
  "allowAccessToAllScopes": false,
  "allowedScopes": [
    "openid",
    "email",
    "address",
    "offline_access",
    "scopeA",
    "scopeB"
  ],
  "identityTokenLifetime": 300,
  "accessTokenLifetime": 60, // TODO - token expiry is only 60 seconds for testing purposes
  "authorizationCodeLifetime": 300,
  "absoluteRefreshTokenLifetime": 86400,
  "slidingRefreshTokenLifetime": 43200,
  "refreshTokenUsage": "OneTimeOnly",
  "updateAccessTokenClaimsOnRefresh": false,
  "refreshTokenExpiration": "Sliding",
  "accessTokenType": "Reference",
  "enableLocalLogin": true,
  "identityProviderRestrictions": [],
  "includeJwtId": false,
  "configClaims": [],

  "alwaysSendClientClaims": true,
  "prefixClientClaims": true,
  "allowAccessToAllCustomGrantTypes": false,
  "allowedCustomGrantTypes": [],
  "allowedCorsOrigins": [
    "http://localhost"
  ],
  "allowAccessTokensViaBrowser": true
}

The token expiration is hard coded in the token. So there is no sliding expiration. You need to request a new access token using the refresh token. — rawel

danijels danijels · Accepted Answer · 2017-06-19T06:33:02

I'm not sure that is a good pattern. A pure javascript application shouldn't deal with offlne_access or resource owner flow. Also, bad idea to push the client secret out to the browser.

That's the whole reason for implicit flow which is designed for js client applications and although you wouldn't be working with refresh tokens, the end result would be the same by renewing access tokens through authorize endpoint.

Brock has a great js lib for this right here: https://github.com/IdentityModel/oidc-client-js

Identity Server 3 - JavaScript Resource Owner Flow with sliding token expiration

1 Answers