{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityModel/oidc-client-js/issues/680","repository_url":"https://api.github.com/repos/IdentityModel/oidc-client-js","labels_url":"https://api.github.com/repos/IdentityModel/oidc-client-js/issues/680/labels{/name}","comments_url":"https://api.github.com/repos/IdentityModel/oidc-client-js/issues/680/comments","events_url":"https://api.github.com/repos/IdentityModel/oidc-client-js/issues/680/events","html_url":"https://github.com/IdentityModel/oidc-client-js/issues/680","id":368837537,"node_id":"MDU6SXNzdWUzNjg4Mzc1Mzc=","number":680,"title":"Check access token validity without silent sign-in","user":{"login":"Lyrencropt","id":1493982,"node_id":"MDQ6VXNlcjE0OTM5ODI=","avatar_url":"https://avatars3.githubusercontent.com/u/1493982?v=4","gravatar_id":"","url":"https://api.github.com/users/Lyrencropt","html_url":"https://github.com/Lyrencropt","followers_url":"https://api.github.com/users/Lyrencropt/followers","following_url":"https://api.github.com/users/Lyrencropt/following{/other_user}","gists_url":"https://api.github.com/users/Lyrencropt/gists{/gist_id}","starred_url":"https://api.github.com/users/Lyrencropt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lyrencropt/subscriptions","organizations_url":"https://api.github.com/users/Lyrencropt/orgs","repos_url":"https://api.github.com/users/Lyrencropt/repos","events_url":"https://api.github.com/users/Lyrencropt/events{/privacy}","received_events_url":"https://api.github.com/users/Lyrencropt/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-10-10T20:24:16Z","updated_at":"2018-10-11T13:54:30Z","closed_at":null,"author_association":"NONE","body":"Unsure if this is a feature request or a question, so apologies.\r\n\r\nRight now I'm in a situation where, on my single-page application, a token might get revoked and I would need to refresh the page. I do this by checking to see if I get a 401 back from my API (I control both the API and the auth server, which is a PingFederate OIDC server). If I do, then I call signInRedirect and force them to log in again.\r\n\r\nUnfortunately there are a few situations arising where we get 401s back, but it doesn't _necessarily_ mean that our token is bad. It could just be that our API is invalidating it incorrectly, or whatever. What I would like to do is, before redirecting them, to check whether our access token (which is just a reference string) is still valid.\r\n\r\nI tried querySessionStatus, but it seems like it relies on session_state being returned (and also the sid property? which I am not entirely sure what it does). However, my server is not maintaining sessions, and is only validating tokens. I get back an id token and a state, but oidc-client doesn't see the session_state that it needs and says \"user not authenticated\".\r\n\r\nDoes this seem like correct behavior? Is my oidc server doing something incorrectly? Is there a simpler/more direct way of doing what I'm trying to do (that isn't just offline \"yep session still says good\")? I'd prefer not to have to manually introspect the access token myself, when that really seems like something my user manager should be doing. "},"comment":{"url":"https://api.github.com/repos/IdentityModel/oidc-client-js/issues/comments/428964424","html_url":"https://github.com/IdentityModel/oidc-client-js/issues/680#issuecomment-428964424","issue_url":"https://api.github.com/repos/IdentityModel/oidc-client-js/issues/680","id":428964424,"node_id":"MDEyOklzc3VlQ29tbWVudDQyODk2NDQyNA==","user":{"login":"brockallen","id":649492,"node_id":"MDQ6VXNlcjY0OTQ5Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/649492?v=4","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2018-10-11T13:54:30Z","updated_at":"2018-10-11T13:54:30Z","author_association":"MEMBER","body":"Access tokens, by design, are opaque to the client. You could do something custom, but it would be beyond what the spec and this library is designed for."}}
{"actor":{"display_login":"brockallen"}}