ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
invalid_grant from a public OAuth client usually traces to token state, a lost PKCE verifier, or config mismatch. A diagnostic order for separating the two grants and fixing each finding.
When OAuth 2.0 refresh tokens aren’t rotated correctly, users face authentication failures and potential security risks. This guide offers a diagnostic checklist, root‑cause mapping, and step‑by‑step fixes to help you pinpoint and resolve rotation issues quickly.
Integration test credential strategy for FusionAuth refresh token flows I need to test an OAuth integration without using production API credentials. The two documented options are a dedicated test tenant with a test API key, or a limited-scope API key created inside the production tenant. Behavior may vary by FusionAuth version, so the deployed release shou
Goal Enforce least‑privilege access and gracefully handle expired JWTs in a Ktor 2.x application. Unresolved Decision When a request arrives with an expired access token, should the application: Option A: Rely on the JWT verifier’s built‑in exp validation, then perform a custom verify lambda that checks roles and optionally initiates a refresh flow via a sep
Goal Determine whether an OAuth 2.0 client may safely use a refreshed token restored from backup without first confirming its validity with the authorization server. Constraints and uncertainty The OAuth 2.0 specification does not define token storage or backup procedures, leaving validation after restoration to the client implementation. Token introspection
Scenario A client uses the OAuth 2.0 Refresh Token grant (RFC 6749, Section 6) against an authorization server that enforces Refresh Token Rotation, as recommended by the OAuth 2.0 Security Best Current Practice. Each successful refresh invalidates the previous refresh token and issues a new one. Failure condition When the client sends a refresh request and
OAuth 2.0 utilizes scopes to enforce least-privilege access, restricting a client to specific data subsets. While the Refresh Token grant type allows clients to obtain new access tokens without re-authentication, the behavior regarding scope reduction during this process remains inconsistent across authorization servers. When a client uses Refresh Token Rota
RFC 6749 makes refresh-token rotation optional: an authorization server MAY issue a new refresh token, and the client MUST discard the old value when one arrives. The draft OAuth 2.1 revision recommends rotation with reuse detection for public clients, but as a draft it does not impose a binding requirement on deployed servers. Because the core framework doe
Goal: maintain repeatable LinkedIn Marketing API OAuth 2.0 authentication in a CI/CD pipeline using access and refresh tokens instead of repeated interactive logins. Uncertainty: refresh-token flow succeeds in interactive sessions but may fail in headless pipelines when LinkedIn session cookies are not preserved. The exact rejection response varies by API ve
oauth
fusion
ktor
linkedin