Refresh Token No Longer Returns id_token
Last Updated:
Overview
Sometime between 00:11 UTC and 1:07 UTC on April 17th the customer's authentications began to fail. The nature of the failure is that they no longer receive an id_token in the response from /oauth/token .
Applies To
- Refresh Token
- id_token
Cause
There was a server update on 4/17/23 that fixed a bug that was allowing for a scenario where if the scope of the initial /authorize request did not include openid, a new ID token would be issued in the response of a subsequent refresh token exchange. The customer had been relying on this returning ID tokens and when the bug fix was applied they no longer were getting one.
Troubleshooting
They have not changed our code during this period, the API response from Auth0 just changed.
Solution
The customer just needed to include openid in the /authorize request for a new ID token to be issued in the response of later refresh token exchanges.
