为什么不返回刷新令牌的到期？

Question

请求访问/刷新令牌时,会发送刷新令牌,但API响应中缺少"refresh_token_expires_in"属性.我不知道官方到期时间戳是什么.为什么缺少记录的财产？

对于授权类型"authorization_code"和"refresh_token"授权请求,我收到相同的响应正文.以下是我收到的一个例子.

{  
   "token_type": "Bearer",
   "expires_in": "3599",
   "scope": "Calendars.Read Calendars.ReadWrite Files.Read Files.ReadWrite User.Read User.Read.All",
   "expires_on": "1455797016",
   "not_before": "1455793116",
   "resource": "https://graph.microsoft.com/",
   "access_token": "eyJ0eXAiOiJKV1QiL...",
   "refresh_token": "AAABAAAAiL9Kn2Z27Uub..."
}

如您所见,仅包括访问令牌到期.一个额外的问题是这个"not_before"是什么？我找不到这个属性意味着什么的参考.

http://graph.microsoft.io/en-us/docs/authorization/app_authorization 使用刷新令牌续订到期访问令牌"新的到期时间是指从expires_in和refresh_token_expires_in值中指定的秒数成功提交令牌刷新请求时."

"获取访问令牌"部分甚至指出:"在任何生产代码中,您的应用需要监视这些令牌的到期,并在刷新令牌到期之前续订过期的访问令牌." 但是,它似乎没有给我应该监控的到期时间.

在getHub上似乎有一个未解决的问题 https://github.com/OfficeDev/microsoft-graph-docs/issues/115

Answer 1

您可以在关闭或过期时检查过期情况，使用刷新令牌请求新的访问令牌：

// Get current time + 5 minutes (to allow for time differences)
$now = time() + 300;
if ($token->expires <= $now) {
    // Token is expired (or very close to it) so let's refresh

    // Initialize the OAuth client
    $oauthClient = new GenericProvider([
        'clientId'                => config('msgraph.clientId'),
        'clientSecret'            => config('msgraph.clientSecret'),
        'redirectUri'             => config('msgraph.redirectUri'),
        'urlAuthorize'            => config('msgraph.urlAuthorize'),
        'urlAccessToken'          => config('msgraph.urlAccessToken'),
        'urlResourceOwnerDetails' => config('msgraph.urlResourceOwnerDetails'),
        'scopes'                  => config('msgraph.scopes')
    ]);

    $newToken = $oauthClient->getAccessToken('refresh_token', ['refresh_token' => $token->refresh_token]);

    return $newToken->getToken();
}

这个例子取自 Laravel 实现，但说明了这个想法。