Lack of 401 when token is expired in iOS client

[jesmrec]

I have noticed this (weird) behaviour with mobile clients using OAuth2, specific in iOS:

When the access token is expired (checking time in DB) and client sends a request, a lack of authorization must be responsed in order to request a new token by using the refresh token. Server v10.0.3 is responsing 200 to the iOS client after token expiration, so the token is never renewed.

Android client, using the same server instance, is being responsed 401 when token expires, as expected.

Version 10.0.3beta works properly in both Android and iOS, so maybe something wrong in the way from 10.0.3beta to 10.0.3.

Example:

Token request in authorization stage:

2017-10-05 12:58:31
POST https://<my_server>/index.php/apps/oauth2/api/v1/token

Server JSON response:

{ "access_token": "6mAKKwcsf4qnZt6qGGPu2GhRmcu4J8lEGPHEbGOIfN0Ge2d994zGCantzStLWMly", "expires_in": 150, "message_url": "https://<my_server>/index.php/apps/oauth2/authorization-successful", "refresh_token": "kfirlcLzxb3Hm0iiSVL6pao7FqvqE6BMZV29AfDpH5EQHuneRFxvY3iEuFq3HZI0", "token_type": "Bearer", "user_id": "user1" }

150 seconds of life from 12:58:31 , that means it is expired at 13:01 aprox.

After waiting...

2017-10-05 13:02:29 GET https://<my_server>/ocs/v1.php/apps/files_sharing/api/v1/shares?path=&subfiles=true <- 200 OK text/xml 109b 188ms
`Authorization: Bearer 6mAKKwcsf4qnZt6qGGPu2GhRmcu4J8lEGPHEbGOIfN0Ge2d994zGCantzStLWMly´

2017-10-05 13:03:22 GET https://<my_server>/remote.php/webdav/ownCloud%20Manual.pdf <- 200 OK application/pdf 4m 2.29s
Authorization: Bearer 6mAKKwcsf4qnZt6qGGPu2GhRmcu4J8lEGPHEbGOIfN0Ge2d994zGCantzStLWMly

over a server
{"installed":"true","maintenance":"false","needsDbUpgrade":"false","version":"10.0.3.3","versionstring":"10.0.3","productname":"ownCloud"}

CC @DeepDiver1975 @nasli @michaelstingl

related owncloud/core#28707

[DeepDiver1975]

I assume this is because the session cookie is transmitted as well and the token is not reevaluated. There is an open issue afaik

[jesmrec]

link?

[DeepDiver1975]

owncloud/core#28733

[SamuAlfageme]

I'm assuming this one could be closed in favor of the more updated #103 - @jesmrec correct me if I'm wrong

[jesmrec]

you are right. closing