Amplify calling token endpoint to refresh token even when Implicit grant flow is used

[jiristanglica]

Do you want to request a feature or report a bug?

Bug

What is the current behavior?

1. Using the implicit grant flow (Amplify configured with Auth.oauth.responseType = 'token'), after redirection from Cognito Hosted UI the idToken and accessToken are correctly populated, refreshToken stays empty - as it is supposed to be:
   
2. After one hour, when the tokens expire, the wrong behaviour comes to the scene. Calling Auth.currentSession() will result in fetching the user session (Auth.ts:851 -> CognitoUser.js:1117) which I think contains the bad code. It loads the tokens from the localStorage and performs the validity (expiry) check (CognitoUser.js:1151).
3. It finds out that the session has expired and checks if the refreshToken == null (CognitoUser.js:1156) in order to use it for the token refresh process. This is the wrong part. As you can see in the picture above, the refreshToken is not null but rather an empty string. This means that the check passes and the refresh token (the empty string) is used in the token endpoint call - and that results in a 400 - Bad Request ({"__type":"InvalidParameterException","message":"Missing required parameter REFRESH_TOKEN"}).

What is the expected behavior?

The check for refreshToken in the CognitoUser.js:1156 file should resolve to false and thus the call to the token endpoint should not be performed.

Which versions of Amplify, and which browser / OS are affected by this issue? Did this work in previous versions?

I'm using latest Chrome (Version 67.0.3396.99 (Official Build) (64-bit)) on Mac and latest Amplify version from npm (0.4.8).

[powerful23]

@Izzy26 thanks for your feedback! We will fix it ASAP.

[github-actions]

This issue has been automatically locked since there hasn't been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels or Discussions for those types of questions.