How do I authenticate an Expo React Native app using PKCE and allow token refresh?

user_2428961 0
Viewed 1125

I feel like I'm missing a trick here. We have a managed Expo app and we're trying to authenticate the user against an OIDC identity provider (in our case it's Cognito).

It seems to two options we have are either expo-auth-session or expo-app-auth.

  • It seems that expo-auth-session will support a PKCE flow, but doesn't have a mechanism for refreshing the token.

  • expo-app-auth, on the other hand, does have a mechanism for refreshing the token but doesn't seem to support a PKCE flow.

I don't want to increase the token timeout because that's a security risk. I also don't want to use an implicit flow because that's also a security risk.

There is an open PR against AuthSession to add refresh token support, but the fact that the library has been out for this long without it makes me wonder if I'm missing something.

Any help much appreciated!

expo react-native openid-connect
1 Answers

AppAuth supports both PKCE and refresh tokens, and is the most recommended option from a security viewpoint, but is tricky to implement. In React Native there is an AppAuth Bridge, though you would have more options with native mobile tech.

I have some code samples and blog posts that highlight AppAuth usage. Steps 8-10 of each post demonstrate PKCE and steps 15-16 demonstrate token refresh:

user_90198850
Related