Heimdallr doesn't refresh token but get a new access token instead about heimdallr.swift

[bckr]

@BabyAzerty Glad to hear it worked out! 🎉
That would have been my suggestion: Maybe your Wireshark log just did not show the query parameter.

Btw: The basic authentication of the token refresh request is to be expected and conform to the RFC spec, if that wasn't clear:

Because refresh tokens are typically long-lasting credentials used to
request additional access tokens, the refresh token is bound to the
client to which it was issued. If the client type is confidential or
the client was issued client credentials (or assigned other
authentication requirements), the client MUST authenticate with the
authorization server as described in Section 3.2.1.

[bckr]

Hey @BabyAzerty!

Im not sure if I understand the problem correctly. Do you have a valid refresh token but the refresh itself does not work for you? Do you get any error logs from Heimdallr in the console?

One thing I've noticed: Your example does not show the required call to requestAccessToken() to initially request your token. I assume this is done somewhere else in your code?

[Kalzem]

I indeed have a successful requestAccessToken on my login form

SharedNetwork.instance.heimdallr.requestAccessToken(username: username, password: password) { result in //...

My problem is that when the access token has expired, instead of doing an OAuth refresh grant, Heimdallr does another requestAccessToken according to WireShark (even though I never call it beside from my login form). The uploaded screenshot shows the call from authenticateRequest(request).

Expected behaviour: authenticateRequest shouldn't send any header but should send form data with grant_type=refresh_token&refresh_token=SOMETHING... when it needs to refresh the token.

Current behaviour: authenticateRequest sends header with Authorization: Basic but no form data when it needs to refresh the token.

[Kalzem]

Okay, I don't know whether it is WireShark that has a problem or not (I think so though) but after trying to log all HTTPHeaders & HTTPBody from Heimdallr and doing additional tests, it seems to be perfectly fine.