App update middleware causing unauthorized errors

[Kyemate]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

When the app is below minimum app version the app will throw an unauthorized error when the refresh token call fail because the ForceUpdateActionFilter is called after the auth middleware

Expected Behavior

No response

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version

No response

Anything else?

No response

[github-actions]

Hello there! I'm a wiki 🤖.

Based on the content of this thread, I've found a potentially relevant wiki page for you!

✨ View Wiki Page

I hope this helps!

[ysmoradi]

If we return NotSupportedClient exception because of client being outdated, then the client will fail to refresh the access token. But in other hand, maybe we've changed the refresh token endpoint itself, and it's not supported for outdated clients anyway.
What's your idea about this?

[Kyemate]

If we return NotSupportedClient exception because of client being outdated, then the client will fail to refresh the access token. But in other hand, maybe we've changed the refresh token endpoint itself, and it's not supported for outdated clients anyway. What's your idea about this?

I think if the user is on an unsupported version the user should only be prompted with an update. After the update the jwt token should try updating again and if something is wrong then throw unauthorized error. Cause in most cases the refresh token will update just fine after the update

[ysmoradi]

When the refresh token fails, but not because of 401, 403, we don't remove the refresh token (Do we?)
So if the app gets updated, later user can refresh the token without need to sign-in again.
What's the benefit of refreshing the token before updating the app? During force update, the user is unable to use the app anyway.
Am I missing something?