Skip to content

Commit 235e314

Browse files
committed
OAuth: Fix infinite loop when the refresh token is expired
The server reply with a code 400 when the token is invalid, the client was understanding this error as a network error, and was retying again with the same token. Instead, we must rely on what the json is saying, even if the reply is not a 200 code. Issue https://github.com/owncloud/enterprise/issues/2777 (cherry picked from commit eb7e074)
1 parent 628daea commit 235e314

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

src/libsync/creds/httpcredentials.cpp

+4-3
Original file line numberDiff line numberDiff line change
@@ -379,11 +379,12 @@ bool HttpCredentials::refreshAccessToken()
379379
QJsonParseError jsonParseError;
380380
QJsonObject json = QJsonDocument::fromJson(jsonData, &jsonParseError).object();
381381
QString accessToken = json["access_token"].toString();
382-
if (reply->error() != QNetworkReply::NoError || jsonParseError.error != QJsonParseError::NoError || json.isEmpty()) {
383-
// Network error maybe?
382+
if (jsonParseError.error != QJsonParseError::NoError || json.isEmpty()) {
383+
// Invalid or empty JSON: Network error maybe?
384384
qCWarning(lcHttpCredentials) << "Error while refreshing the token" << reply->errorString() << jsonData << jsonParseError.errorString();
385385
} else if (accessToken.isEmpty()) {
386-
// The token is no longer valid.
386+
// If the json was valid, but the reply did not contain an access token, the token
387+
// is considered expired. (Usually the HTTP reply code is 400)
387388
qCDebug(lcHttpCredentials) << "Expired refresh token. Logging out";
388389
_refreshToken.clear();
389390
} else {

0 commit comments

Comments
 (0)