Issues with Refresh Token Handling in OAuth 2.0

Hello everyone,

I'm encountering a persistent issue with handling refresh tokens in my custom Power BI connector, and I could use some expert advice.

Problem Description:

• I building a custom Power BI connector that uses OAuth 2.0 PKCE for authentication.
• The initial access token is retrieved successfully, but I'm running into problems when trying to use the refresh token to obtain a new access token.

Details:

1. Token and Expiration: Along with the access token, we receive an expiration time and a refresh token.

2. Long Data Fetch Duration: Fetching data takes more than 1 hour, during which the access token expires, necessitating a new access token.

3. Refresh Token Request Issue: When attempting to use the refresh token, the refresh request is sent twice in quick succession:

   • The first request is successful and returns a new access token.
   • The second request fails because it tries to use the same refresh token that was just invalidated by the first successful request.(Checking all the requests in Fiddler)

4. User Interruption: This issue causes an interruption where a window is displayed asking users to re-enter their credentials while data is being fetched from the API.
   
   

Current Implementation:

StartLogin = (resourceUrl, state, display) =>
    let
        codeVerifier = Text.NewGuid() & Text.NewGuid(),
        AuthorizeUrl = authorizationUri
            & "?"
            & Uri.BuildQueryString(
                [
                    client_id = clientId,
                    response_type = "code",
                    code_challenge_method = "plain",
                    scope = scope,
                    code_challenge = codeVerifier,
                    state = state,
                    redirect_uri = callbackUri
                ]
            )
    in
        [
            LoginUri = AuthorizeUrl,
            CallbackUri = callbackUri,
            WindowHeight = 800,
            WindowWidth = 600,
            Context = codeVerifier
        ];

FinishLogin = (context, callbackUri, state) =>
    let
        Parts = Uri.Parts(callbackUri)[Query]
    in
        TokenMethod(Parts[code], "authorization_code", context);

TokenMethod = (code, grant_type, optional verifier) =>
    let
        codeVerifier = if (verifier <> null) then [code_verifier = verifier] else [],
        codeParameter = if (grant_type = "authorization_code") then [code = code] else [refresh_token = code],
        query = codeVerifier
            & codeParameter
            & [
                client_id = clientId,
                grant_type = grant_type,
                redirect_uri = callbackUri
            ],
        ManualHandlingStatusCodes = {400, 403},
        Response = Web.Contents(
            tokenUri,
            [
                Content = Text.ToBinary(Uri.BuildQueryString(query)),
                Headers = [
                    #"Content-type" = "application/x-www-form-urlencoded",
                    #"Accept" = "application/json"
                ],
                ManualStatusHandling = ManualHandlingStatusCodes
            ]
        ),
        Parts = Json.Document(Response)
    in
        // check for error in response
         if (Parts[error]? <> null) then
             error Error.Record(Parts[error], Parts[message]?)
         else
            Parts;

Refresh = (resourceUrl, refresh_token) =>
    TokenMethod(refresh_token, "refresh_token");

// Data Source Kind description
SampleConnector = [
    Authentication = [
        OAuth = [
            StartLogin = StartLogin,
            FinishLogin = FinishLogin,
            Refresh = Refresh
        ]
    ],
    Label = "Sample Connector"
];