How to refresh expired google sign-in logins?

Question

I'm using Google Sign-In. A user comes to my site and logs in with gapi.auth2.getAuthInstance().signIn(), or they are already logged in and when the page loads (or reloads) we fetch the status. At this point I have an identity token good for an hour that I can validate on the server.

When a user leaves the browser sitting (say, overnight), this token expires. gapi.auth2.getAuthInstance().isSignedIn.get() returns true, but the token does not validate.

How can I log in a user and keep them logged in while their session is active (ie, browser hasn't been closed)? Or refresh the token? Anything more graceful than reloading the page...

Edit: The refresh token is not a correct answer; I don't want offline access (and don't want to ask for the permission). Google obviously thinks the user is still signed into my application; the user can reload the page and get a new token without providing credentials again. Surely there is some mechanism more graceful than a hidden iframe to get an updated token?

Answer 1

If the token is expired, you can call gapi.auth2.getAuthInstance().currentUser.get().reloadAuthResponse(). It returns a Promise.

Answer 2

FWIW, we've managed to (mostly) make it work via a listener approach. It appears that 'userChanged' callback is invoked ~5 minutes before the access token expires. That's enough for us to extract and update the access token without refreshing the page.

What does not quite work though is when computer comes back from sleep. This can be solved relatively easy by reloading the page on wake up.

Answer 3

You can accomplish this with listeners.

var auth2 = gapi.auth2.getAuthInstance();

// Listen for changes to current user.
// (called shortly before expiration)
auth2.currentUser.listen(function(user){

    // use new user in your OpenID Connect flow

});

This will allow you to keep current credentials, as long as the browser remains active.

If the computer is put to sleep additional work must done to get current credentials.

if (auth2.isSignedIn.get() == true) {
    auth2.signIn();
}

Answer 4

You can use Refresh Token to get offline access. As per the official reference

Access tokens have limited lifetimes. If your application needs access to a Google API beyond the lifetime of a single access token, it can obtain a refresh token. A refresh token allows your application to obtain new access tokens.

Basically you will get the refresh token the first time you ask for authentication. You need to save that token securely for future use. The access token (you mentioned as identity token) expires after an hour. After that you have to use the refresh token each time you want to get a new usable access token.

Depending on the client library you are using the syntax will differ. following is a sample for php client library.

// get access token from refresh token if access token expire

if($client->getAuth()->isAccessTokenExpired()) {
    $client->refreshToken($securelyPreservedRefreshToken);
    $newToken = $client->getAccessToken();
}

check this for details steps.