Skip to content

refresh_token missing for client_credentials grant #350

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
z1haze opened this issue Jun 2, 2025 · 0 comments · May be fixed by #351
Open

refresh_token missing for client_credentials grant #350

z1haze opened this issue Jun 2, 2025 · 0 comments · May be fixed by #351

Comments

@z1haze
Copy link

z1haze commented Jun 2, 2025

Describe the bug

I'm not sure why, but the refresh_token is not being returned from the saveToken call for the client_credentials grant. I've tried to poke through the RFC to see if there's anything that says a refresh token should not be returned, and I don't see anything, but definitely in the code of client-credentials-grant-type.js#saveToken, you are not returning a refresh token, but authorization-code-grant-type.js#saveToken does.

To Reproduce

Steps to reproduce the behavior:

  1. oauthServer.token call with client_credentials grant and notice there is no refresh token being generated, as described above.
  2. Repeat process for authorization_code grant type and it is generated. I feel like this may be a miss.

Expected behavior

A refresh token should be returned for all token requests, regardless of the grant type used.

@z1haze z1haze linked a pull request Jun 2, 2025 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant