Fix error handling on failed token refresh

Now a failed token refresh process clears the previous refresh token and returns a 302 to the client so that the authentication process can start afresh.

Author: lcrilly

openid_connect.js

@@ -85,28 +85,30 @@ function oidcCodeExchange(r) {
 }
 
 function oidcRefreshRequest(r) {
-    // Pass the refresh token code to the /_refresh location so that it can be
+    // Pass the refresh token to the /_refresh location so that it can be
     // proxied to the IdP in exchange for a new id_token
     r.subrequest("/_refresh", "token=" + r.variables.refresh_token,
         function(reply) {
-            if (reply.status == 504) {
-                r.error("OIDC timeout connecting to IdP when sending refresh request");
-                r.return(504);
-                return;
-            }
-
             if (reply.status != 200) {
-                try {
-                    var errorset = JSON.parse(reply.responseBody);
-                    if (errorset.error) {
-                        r.error("OIDC error from IdP when sending refresh request: " + errorset.error + ", " + errorset.error_description);
-                    } else {
-                        r.error("OIDC unexpected response from IdP when sending refresh request (HTTP " + reply.status + "). " + reply.responseBody);
+                // Refresh request failed, log the reason
+                var error_log = "OIDC refresh failure";
+                if (reply.status == 504) {
+                    error_log += ", timeout waiting for IdP";
+                } else if (reply.status = 400) {
+                    try {
+                        var errorset = JSON.parse(reply.responseBody);
+                        error_log += ": " + errorset.error + " " + errorset.error_description;
+                    } catch (e) {
+                        error_log += ": " + reply.responseBody;
                     }
-                } catch (e) {
-                    r.error("OIDC unexpected response from IdP when sending refresh request (HTTP " + reply.status + "). " + reply.responseBody);
+                } else {
+                    error_log += " "  + reply.status;
                 }
-                r.return(502);
+                r.error(error_log);
+
+                // Clear the refresh token, try again
+                r.variables.refresh_token = "-";
+                r.return(302, r.variables.request_uri);
                 return;
             }
 
@@ -118,20 +120,22 @@ function oidcRefreshRequest(r) {
                     if (tokenset.error) {
                         r.error("OIDC " + tokenset.error + " " + tokenset.error_description);
                     }
-                    r.return(500);
+                    r.variables.refresh_token = "-";
+                    r.return(302, r.variables.request_uri);
                     return;
                 }
 
                 // Send the new ID Token to auth_jwt location for validation
                 r.subrequest("/_id_token_validation", "token=" + tokenset.id_token,
                     function(reply) {
                         if (reply.status != 204) {
-                            r.return(500); // validateIdToken() will log errors
+                            r.variables.refresh_token = "-";
+                            r.return(302, r.variables.request_uri);
                             return;
                         }
 
                         // ID Token is valid, update keyval
-                        r.log("OIDC updating id_token");
+                        r.log("OIDC refresh success, updating id_token");
                         r.variables.session_jwt = tokenset.id_token; // Update key-value store
 
                         // Update refresh token (if we got a new one)
@@ -140,13 +144,13 @@ function oidcRefreshRequest(r) {
                             r.variables.refresh_token = tokenset.refresh_token; // Update key-value store
                         }
 
-                        r.log("OIDC refresh success");
                         r.internalRedirect(r.variables.request_uri); // Continue processing original request
                     }
                 );
             } catch (e) {
-                r.error("OIDC refresh response is not JSON. " + reply.responseBody);
-                r.return(502);
+                r.variables.refresh_token = "-";
+                r.return(302, r.variables.request_uri);
+                return;
             }
         }
     );