GetTokenSilentlyVerboseResponse - do not omit refresh_token

[collin-thomas]

Checklist

• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the documentation and API documentation, and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

I need access to the access token, id token, and refresh token. However, the GetTokenSilentlyVerboseResponse of getAccessTokenSilently() omits refresh_token.

The developer already specifies detailedResponse: true as part of the arguments to getAccessTokenSilently(). So, I would argue that omitting the refresh_token is counterintuitive.

See

auth0-spa-js/src/global.ts

Lines 648 to 651 in f2e5668

	export type GetTokenSilentlyVerboseResponse = Omit<
	TokenEndpointResponse,
	'refresh_token'
	>;

Describe the ideal solution

#1 Modify the type GetTokenSilentlyVerboseResponse to not omit refresh_token.
Modify Type:

auth0-spa-js/src/global.ts

Lines 648 to 651 in f2e5668

	export type GetTokenSilentlyVerboseResponse = Omit<
	TokenEndpointResponse,
	'refresh_token'
	>;

#2 Destructure refresh_token from authResult and add it to the return object.
Change Code:

auth0-spa-js/src/Auth0Client.ts

Lines 718 to 726 in f2e5668

	const { id_token, access_token, oauthTokenScope, expires_in } =
	authResult;
	return {
	id_token,
	access_token,
	...(oauthTokenScope ? { scope: oauthTokenScope } : null),
	expires_in
	};

Alternatives and current workarounds

No response

Additional context

This issue #715 states that refresh_token is not returned for security reasons. What security reasons?

We cannot return all the information from the exchange. For example, we would not return the refresh token for security reasons. By default we already strip this off and hold it internally.

The only time I've seen someone else reference the refresh_token being omitted from the response is in this issue #1013

[abmagil]

I also have a need for the refresh token. In my case, I would like to give the user a warning that their access is about to end but this isn't possible with invisible refresh tokens: I can parse the access token to know when it expires but that's irrelevant when there is a refresh token that would renew their access. I would like to also parse the refresh token to get the expiration but I cannot because it is hidden from me