[GH-ISSUE #396] PKCE Auth - refetch_token triggers status 400 bad request due to revoked refresh token #129

New issue

Closed

opened 2026-02-27 20:23:16 +03:00 by kerem · 3 comments

kerem commented

2026-02-27 20:23:16 +03:00

Owner

Originally created by @ndoolan360 on GitHub (Mar 29, 2023).
Original GitHub issue: https://github.com/ramsayleung/rspotify/issues/396

Describe the bug
The refetch_token method in the BaseClient of AuthCodePkceSpotify keeps the original refresh_token after refetching causing an error response with Status 400 (Bad Request)

To Reproduce
Steps to reproduce the behavior:

Create an AuthCodePkceSpotify client configured with token_cache
Refresh the token a number of times

Notice that the initial tokens and the first refresh are successful and the access_token is updated, however, the refresh_token remains the same after refresh.
On subsequent attempts to refresh, the client errors with Status 400 Bad Request.

Expected behavior
I expect the new refresh token returned by the request to be returned by refetch_token and stored in the cache by refresh_token.

Log/Output data
log.txt
From recreating the request in postman the body is:

{
    "error": "invalid_grant",
    "error_description": "Refresh token revoked"
}

Additional context
This appears to occur because of auth_code_pkce.rs line 75

Spotify Community Discussion

A refresh token that has been obtained through PKCE can be exchanged for an access token only once, after which it becomes invalid.

Is this just to do with my use case?
Do we know why it is that we need to keep the same refresh_token after the refetch?

Originally created by @ndoolan360 on GitHub (Mar 29, 2023). Original GitHub issue: https://github.com/ramsayleung/rspotify/issues/396 **Describe the bug** The `refetch_token` method in the `BaseClient` of `AuthCodePkceSpotify` keeps the original refresh_token after refetching causing an error response with Status 400 (Bad Request) **To Reproduce** Steps to reproduce the behavior: 1. Create an AuthCodePkceSpotify client configured with `token_cache` 2. Refresh the token a number of times - Notice that the initial tokens and the first refresh are successful and the access_token is updated, however, the refresh_token remains the same after refresh. - On subsequent attempts to refresh, the client errors with Status 400 Bad Request. **Expected behavior** I expect the new refresh token returned by the request to be returned by `refetch_token` and stored in the cache by `refresh_token`. **Log/Output data** [log.txt](https://github.com/ramsayleung/rspotify/files/11097089/log.txt) From recreating the request in postman the body is: ```json { "error": "invalid_grant", "error_description": "Refresh token revoked" } ``` **Additional context** This appears to occur because of auth_code_pkce.rs line 75 --- [Spotify Community Discussion](https://community.spotify.com/t5/Spotify-for-Developers/Refresh-token-revoked/m-p/5190859/highlight/true#M2406) > A refresh token that has been obtained through PKCE can be exchanged for an access token only once, after which it becomes invalid. --- Is this just to do with my use case? Do we know why it is that we need to keep the same refresh_token after the refetch?

kerem

2026-02-27 20:23:16 +03:00

closed this issue
added the
help wanted

bug
labels

kerem commented

2026-02-27 20:23:17 +03:00

Author

Owner

@ramsayleung commented on GitHub (May 30, 2023):

I think the refresh token logic the pkce just borrowed from auth_code.rs, we should replace the old refresh token with the new fresh token retuned by the request.

@ramsayleung commented on GitHub (May 30, 2023): I think the refresh token logic the `pkce` just borrowed from `auth_code.rs`, we should replace the old refresh token with the new fresh token retuned by the request.

kerem commented

2026-02-27 20:23:17 +03:00

Author

Owner

@mlehmk commented on GitHub (Jun 5, 2023):

The new refresh token is overwritten by the retained refresh token in line 77 of auth_code_pkce.rs of github.com/ramsayleung/rspotify@4360c096f2/src/auth_code_pkce.rs
Removing that line seems to fix this issue

The PKCE protocol invalidates the old refresh token, due to a protection against token extraction. The token refresh also gives a new refresh token and remembers the old refresh token, so in case a refresh is issued with the old refresh token the whole session is invalidated.

@mlehmk commented on GitHub (Jun 5, 2023): The new refresh token is overwritten by the retained refresh token in line 77 of auth_code_pkce.rs of https://github.com/ramsayleung/rspotify/blob/4360c096f2e1d827bd52b998dc3c1bfde18c456d/src/auth_code_pkce.rs Removing that line seems to fix this issue The PKCE protocol invalidates the old refresh token, due to a protection against token extraction. The token refresh also gives a new refresh token and remembers the old refresh token, so in case a refresh is issued with the old refresh token the whole session is invalidated.

kerem commented

2026-02-27 20:23:17 +03:00

Author

Owner

@ramsayleung commented on GitHub (Jun 14, 2023):

This problem has been fixed, feel free to retry with the latest commit :)

@ramsayleung commented on GitHub (Jun 14, 2023): This problem has been fixed, feel free to retry with the latest commit :)

kerem referenced this issue

2026-02-27 20:24:00 +03:00

[PR #129] [MERGED] Multiple clients via features #260