Skip to content

[Bug]: The lost of refresh token in Google OAuth #763

Closed
@figwood

Description

@figwood

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

When login with Google account, it will return an access_token and an refresh_token, the access_token will be expired in about an hour, but the refresh_token will be valid all the time and it is used to get a new access_token, see here . In lowcoder, both of them will be stored in DB, but the problem is that the refresh_token will only be returned in the first time user login, if users logout and re-login, it will return null in refresh_token and once it has been stored in DB, we will lose refresh_token.

Without refresh_token, the access_token can't be refreshed automatically, users have to re-login again every hour, which is quite annoying.

It could be easily solved by adding these code in updateConnection function, ,

        //if auth by google, set refresh token
        if (authUser.getSource().equals(AuthSourceConstants.GOOGLE)) {
            authUser.getAuthToken().setRefreshToken(oldConnection.getAuthConnectionAuthToken().getRefreshToken());
        }

but it's too ugly, hope there could be any better solutions.

Expected Behavior

Users don't have to re-login every hour after login with Google account.

Steps to reproduce

  1. login with Google account
  2. logout
  3. re-login with same Google account
  4. wait an hour, refresh the page, it will redirect to login form

Environment

No response

Additional Information

No response

Metadata

Metadata

Assignees

Labels

API-ServiceBackend Java Spring for the Lowcoder APIEnhancementNew feature or requestJava BackendPull requests that update Java code

Type

No type

Projects

Status

✅ Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions