Skip to content

fix(#947): only call refresh when auth token is expired #1087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
phoenix-ru merged 2 commits into from
Apr 2, 2026
+6 −4
Merged

fix(#947): only call refresh when auth token is expired #1087

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4c4fabd
fix(refresh-token): only refresh when auth token is expired
Mar 25, 2026
a89a929
fix(refresh-token): PR requested changes
Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 2 additions & 8 deletions src/runtime/plugins/refresh-token.server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,22 +9,16 @@ export default defineNuxtPlugin({
const { rawToken, rawRefreshToken, refreshToken, token, lastRefreshedAt }
= useAuthState()

if (refreshToken.value && token.value) {
if (refreshToken.value && !token.value) {

@phoenix-ru phoenix-ru Mar 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While I fully agree with the proposed implementation, I think that we still should conditionally add the access token to headers as it was before to keep compatibility with servers which expect it:

Suggested change
if (refreshToken.value && !token.value) {
if (refreshToken.value) { 
// include header in case of auth is required to avoid 403 rejection
const headers = token.value
  ? new Headers({
      [provider.token.headerName]: token.value
    } as HeadersInit)
  : undefined

Otherwise it can be considered a breaking change.

Note for the context: local provider would likely be deprecated in version 2 due to sometimes ambiguous implementations like the current one, where library doesn't know the full usecase, such as what is required by the underlying back-end for the refresh call. Instead, users will be able to customize the behaviour and exact requirements of their backend when #1062 lands (currently pending team review).

@anjarupnik anjarupnik Mar 31, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @phoenix-ru, thanks for the quick review. I’ve applied your suggestion. Keeping the access token in the headers conditionally makes sense here to preserve compatibility with backends that require it and to avoid a breaking change.

I also like the direction of the new approach, because cases like this show how hard it is for the library to support every backend-specific use case. For example, with the current approach, we may refresh the token unnecessarily on every page load, since we do not check whether the existing token is expired first.

@phoenix-ru phoenix-ru Apr 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I will do a functional check tomorrow and we can merge this

const provider = useTypedBackendConfig(useRuntimeConfig(), 'local')

const { path, method } = provider.refresh.endpoint
const refreshRequestTokenPointer = provider.refresh.token.refreshRequestTokenPointer

// include header in case of auth is required to avoid 403 rejection
const headers = new Headers({
[provider.token.headerName]: token.value
} as HeadersInit)

try {
const response = await _fetch<Record<string, any>>(nuxtApp, path, {
method,
body: objectFromJsonPointer(refreshRequestTokenPointer, refreshToken.value),
headers
body: objectFromJsonPointer(refreshRequestTokenPointer, refreshToken.value)
})

const tokenPointer = provider.refresh.token.refreshResponseTokenPointer || provider.token.signInResponseTokenPointer
Expand Down
Loading