Kong / Kong/insomnia

OAuth 2 token refresh fails

Open
#5,798 11 comments 5 reactions 0 assignees View on GitHub
A-oauth B-bug S-unverified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

### Expected Behavior

Refreshing tokens whether manually or automatically should work. It previously worked, but one of the more recent updates seems to have broken it.

### Actual Behavior

Clicking refresh shows
[oauth2] Failed to refresh token url=https://[omitted]/connect/token status=400

A work around is to clear and fetch tokens again, where it gets issued a new id/access/refresh token. I have taken the refresh token and tested manually that it works.

It seems that something insomnia is passing with the connect/token request, perhaps in the body, is not correct and the identity server is rejecting it with a 400.

I'm unable to dig into any details about the request. There is no 'response timeline' button like a successful OAuth 2 request would give.

**Another work around is to roll back to 2022.7.0 which can refresh correctly**

### Reproduction Steps

1. Navigate to a previously working request
2. Open OAuth 2 authentication section
3. Click 'Refresh Token'

### Is there an existing issue for this?

- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.

### Additional Information

Both 2023.1.0-beta.3 and 2022.7.5 have this problem.

### Insomnia Version

2022.7.5

### What operating system are you using?

macOS

### Operating System Version

Ventura 13.2.1

### Installation method

downloaded from insomnia.rest. also auto update.

### Last Known Working Insomnia version

2022.7.0

Contributor guide

Open the contributing guide

Research direction

Start with the OAuth 2 authentication section and reproduce token refresh against the reported connect/token endpoint using Insomnia 2022.7.5, 2023.1.0-beta.3, and the last known working 2022.7.0. Compare the refresh request and response behavior; done means manual and automatic refresh work without clearing and fetching tokens again.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.