MaikuB / MaikuB/flutter_appauth

Android app crash on empty refresh token - no exception is thrown

Open
#396 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Objective-C
Stars
308
Forks
301
Avg merge
2d 11h
Merged PRs (30d)
5

Description

Using version 4.2.0 of flutter_appauth on Samsung Galaxy 7 with OS 12.

To Reproduce:

1) Setup a server that is misconfigured and will return a refresh_token of empty string when responding to the token endpoint.
2) Call appAuth.authorize() followed by appAuth.token() on the server, but surround the call with a try-catch block. Run this on Android.

Result:
App shutdown with FATAL EXCEPTION error as follows:

E/AndroidRuntime(17080): java.lang.IllegalArgumentException: refresh token must not be empty if defined
E/AndroidRuntime(17080): at net.openid.appauth.Preconditions.checkArgument(Preconditions.java:116)
E/AndroidRuntime(17080): at net.openid.appauth.Preconditions.checkNotEmpty(Preconditions.java:68)
E/AndroidRuntime(17080): at net.openid.appauth.Preconditions.checkNullOrNotEmpty(Preconditions.java:89)
E/AndroidRuntime(17080): at net.openid.appauth.TokenResponse$Builder.setRefreshToken(TokenResponse.java:305)
E/AndroidRuntime(17080): at net.openid.appauth.TokenResponse$Builder.fromResponseJson(TokenResponse.java:222)
E/AndroidRuntime(17080): at net.openid.appauth.AuthorizationService$TokenRequestTask.onPostExecute(AuthorizationService.java:688)
E/AndroidRuntime(17080): at net.openid.appauth.AuthorizationService$TokenRequestTask.onPostExecute(AuthorizationService.java:579)
E/AndroidRuntime(17080): at android.os.AsyncTask.finish(AsyncTask.java:771)
E/AndroidRuntime(17080): at android.os.AsyncTask.access$900(AsyncTask.java:199)
E/AndroidRuntime(17080): at android.os.AsyncTask$InternalHandler.handleMessage(AsyncTask.java:788)
E/AndroidRuntime(17080): at android.os.Handler.dispatchMessage(Handler.java:106)
E/AndroidRuntime(17080): at android.os.Looper.loopOnce(Looper.java:226)
E/AndroidRuntime(17080): at android.os.Looper.loop(Looper.java:313)
E/AndroidRuntime(17080): at android.app.ActivityThread.main(ActivityThread.java:8751)
E/AndroidRuntime(17080): at java.lang.reflect.Method.invoke(Native Method)
E/AndroidRuntime(17080): at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:571)
E/AndroidRuntime(17080): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1135)
I/Process (17080): Sending signal. PID: 17080 SIG: 9

Expected:
Catch block to be entered.

In other words, server errors should not cause the app to crash.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Android path used by appAuth.authorize() and appAuth.token(), then trace the reported TokenResponse.Builder.fromResponseJson and AuthorizationService.TokenRequestTask calls. Reproduce the empty refresh_token response and verify that the error reaches the Dart try-catch block instead of terminating the Android app.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, dart, flutter, java
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.