azure - 请求刷新 token 失败。在 token 存储中找不到刷新 token

Question

我正在尝试从应用服务获取 Google 的刷新 token ，但无法。

日志说

2016-11-04T00:04:25 PID[500] Verbose Received request: GET https://noteappsvr.azurewebsites.net/.auth/login/google?access_type=offline 2016-11-04T00:04:25 PID[500] Verbose Downloading OpenID configuration from https://accounts.google.com/.well-known/openid-configuration

2016-11-04T00:04:25 PID[500] Verbose Downloading OpenID issuer keys from https://www.googleapis.com/oauth2/v3/certs

2016-11-04T00:04:25 PID[500] Information Redirecting: https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=299597639...04000925%26redir%3D&access_type=offline

2016-11-04T00:05:17 PID[500] Verbose Received request: GET https://noteappsvr.azurewebsites.net/.auth/login/google/callback?state=nonce%3D5656e1dd...&prompt=none

2016-11-04T00:05:17 PID[500] Verbose Calling into external HTTP endpoint POST https://www.googleapis.com/oauth2/v4/token.

2016-11-04T00:05:18 PID[500] Information Login completed for '[email protected]'. Provider: 'google'.

2016-11-04T00:05:18 PID[500] Verbose Writing 'AppServiceAuthSession' cookie for site 'noteappsvr.azurewebsites.net'. Length: 728.

2016-11-04T00:05:18 PID[500] Information Redirecting: https://noteappsvr.azurewebsites.net/.auth/login/done#token=%7B%22authenti...d6ffa9924e5%22%7D%7D

2016-11-04T00:05:50 PID[500] Verbose Received request: GET https://noteappsvr.azurewebsites.net/.auth/refresh

2016-11-04T00:05:50 PID[500] Verbose JWT validation succeeded. Subject: 'sid:4fd4f6...', Issuer: 'https://noteappsvr.azurewebsites.net/'.

2016-11-04T00:05:50 PID[500] Warning The refresh request issued by sid:4fd4f6... failed because no refresh tokens were found in the token store.

2016-11-04T00:05:50 PID[500] Information Sending response: 403.80 Forbidden

token 存储中似乎没有刷新 token ，但为什么？我已经在门户上打开了 token 存储设置。

Answer 1

如果 Google 检测到它已经向您的用户提供了刷新 token ，那么除非您明确提示用户同意，否则它不会提供额外的刷新 token 。您可以通过将 prompt=consent 查询字符串参数添加到登录 URL 来完成此操作。在你的情况下，https://noteappsvr.azurewebsites.net/.auth/login/google?access_type=offline&prompt=consent

尝试此操作，看看是否可以恢复 Google 刷新 token 。

有关此行为的 Google 文档可以在此处找到(在 HTTP/REST 选项卡下):https://developers.google.com/identity/protocols/OAuth2WebServer#offline

Important: When your application receives a refresh token, it is important to store that refresh token for future use. If your application loses the refresh token, it will have to re-prompt the user for consent before obtaining another refresh token. If you need to re-prompt the user for consent, include the prompt parameter in the authorization code request, and set the value to consent.

正常使用时，刷新 token 不应丢失。如果您遇到丢失的情况，请告诉我。