Expiry of refresh token - Jira Cloud oAuth2 3LO grants

[szn]

I can see @alonsabi @KevinGreenan @ArtiomVasiliev @anon12976859 @HossamAhemd @DanielSadilek you experience similar problems as the one described in my latest thread:

OAuth rotating tokens: Unknown or invalid refresh token

Yet another post on that topic. But most of the existing posts describe early development phases. In my case, I successfully implemented both oAuth2 and newly introduce rotating refresh tokens. It was a painful process through misleading documentation. I documented the process in this post: Confluence Addon talking to Jira (cloud). In most of cases, my solution works like expected. Unfortunately time to time my error log is flooded by Unknown or invalid refresh token. I know what the document…

I haven’t found a solution yet, but I am digging into @tbinna’s idea. He suggested, that the problem actually starts one token refresh request earlier when the response from auth.atlassian.com is missing the refresh_token property.

The latest official info I was able to find was in this massive thread:

Superseded: 31 January 2022 - Action required - Deprecating persistent refresh tokens

Hey @KevinGreenan and @FatmehShuman, sorry for keeping you waiting! I wanted to make sure I give you a complete reply. Following your comments we checked our rotating refresh tokens (RRT) config and found that it didn’t match the behaviour we described, nor the one we were going for. This config mistake on our end was what led to your experience, but again, it wasn’t intended. This also prompted us to conduct a quick review of our RRT settings and finally we agreed on the following as a balance…

If I understand @Nir’s statement, this is actually a bug that makes all the refresh tokens invalid after 30 days regardless of whether they are used/rotated or not.

Sadly, the above does not explain the missing refresh_token property in some of the responses.