Expiry of refresh token - Jira Cloud oAuth2 3LO grants

[alonsabi]

I’m also seeing this issue. I switched my app to use the rotating refresh tokens as recommended, and my app stores the new refresh token when receiving a new access token.

My app syncs with JIRA twice a day. What I notice, is that it works for a period of time (a week, to a month), and suddenly it doesn’t, and the user has to reconnect the app with JIRA.

[KevinGreenan]

@alonsabi I am seeing the same behavior. See this post

It appears that the expiry does not apply to the individual refresh token, but the chain of tokens generated after the user initiates the OAuth2 flow. I see a repeatable pattern of the rotations working for exactly 30 days, followed by a 403.

Still waiting on a response from Atlassian… We may have to fall-back on OAuth1, since it is pretty unreasonable to ask app users to periodically re-auth.

[szn]

I can see @alonsabi @KevinGreenan @ArtiomVasiliev @anon12976859 @HossamAhemd @DanielSadilek you experience similar problems as the one described in my latest thread:

OAuth rotating tokens: Unknown or invalid refresh token

Yet another post on that topic. But most of the existing posts describe early development phases. In my case, I successfully implemented both oAuth2 and newly introduce rotating refresh tokens. It was a painful process through misleading documentation. I documented the process in this post: Confluence Addon talking to Jira (cloud). In most of cases, my solution works like expected. Unfortunately time to time my error log is flooded by Unknown or invalid refresh token. I know what the document…

I haven’t found a solution yet, but I am digging into @tbinna’s idea. He suggested, that the problem actually starts one token refresh request earlier when the response from auth.atlassian.com is missing the refresh_token property.

The latest official info I was able to find was in this massive thread:

Superseded: 31 January 2022 - Action required - Deprecating persistent refresh tokens

Hey @KevinGreenan and @FatmehShuman, sorry for keeping you waiting! I wanted to make sure I give you a complete reply. Following your comments we checked our rotating refresh tokens (RRT) config and found that it didn’t match the behaviour we described, nor the one we were going for. This config mistake on our end was what led to your experience, but again, it wasn’t intended. This also prompted us to conduct a quick review of our RRT settings and finally we agreed on the following as a balance…

If I understand @Nir’s statement, this is actually a bug that makes all the refresh tokens invalid after 30 days regardless of whether they are used/rotated or not.

Sadly, the above does not explain the missing refresh_token property in some of the responses.

[TomaszKrakowiak]

Is this going to be fixed any time soon?

[ZhiweiDeng]

Hi, I meet the same problem. have you found the solution?

[KUKADIYAJENIL]

Did you find the way?

[KUKADIYAJENIL]

Did you find the way?

[JenilKukadiya]

Have you found the solution?

[JenilKukadiya]

I got the same error.Please give me a solution if you found out.

[AditiJadeja]

[18:20] Jenil Kukadiya

Issue with Jira API integration: Updating Refresh Token after Periods of Inactivity

In my code, I’ve integrated with the Jira site using the API https://auth.atlassian.com/oauth/token. The logic in my code aims to update the refresh token after 15 days of token inactivity and store this new refresh token for subsequent use. However, I’ve encountered an issue where, after a certain period of inactivity, my application disconnects from the Jira site. Could you please assist me in identifying the potential issues within my code that might be causing this disconnection?