Issue token refresh before token expiry

[alicehelen]

Please advice is there an option to continuously check if the token is going to get expired and before the token expires (like only 25% of the expiry time is still left) have to request for refresh token

[lboyette-okta]

When a token is added to the tokenManager, renewing the tokens is handled for you automatically: https://github.com/okta/okta-auth-js#tokenmanageraddkey-token.

[alicehelen]

Thank you. I also have another question about validating received ID tokens like verifying the signature and claims in the ID token.
I was able to decode the ID token from tokenManager using decodeToken function, Can you advice if there is any library to validate the signature

[alicehelen]

As mentioned in the doc, I am using method token.verify to validate the token. This method validates the token claims and signature. I will use the decode method and perform additional validation like verifying the issuer, issued time in addition to token.verify method.
Can you verify if this would be a proper solution. Thanks!

[lboyette-okta]

The tokenManager also handles verification for you, so if you get a token from the tokenManager, it's a verified token.

[cmckni3]

I am having issues where the token I get back from tokenManager was valid but has either expired or was revoked.

Should this be the case?

[kevlened]

@cmckni3

Currently, if you attempt to get a token immediately on page load, it's possible to get a token that has expired.

The tokenManager is unaware of revoked tokens, but the userinfo endpoint (token.getUserInfo) and your api should reject revoked access tokens when you try to use them. Note that your api must be configured to hit the introspection endpoint to support token revocation.

[cmckni3]

Ok, I was under the impression that verifying the token would handle that and that tokenManager had verified the tokens before returning them.

[kevlened]

It does handle expiration validation (not revocation). The page load issue is due to a race condition. The tokenManager will identify an expired token and start a refresh on page load, but the synchronous tokenManager.get('token') call will return the expired token before the refresh is finished.

[jmelberg-okta]

Hi @alicehelen,

We're going to close this with respect to #125. We're working on getting a fix in soon to resolve this issue.

Thanks!