From 73c80a8b4e45da1fe7d1f71b257edd6d37bad157 Mon Sep 17 00:00:00 2001 From: Nikhil Sinha Date: Wed, 28 Oct 2026 14:51:50 +0530 Subject: [PATCH 1/2] remove expired session if refresh token missing return 401 Unauthorized error this avoids openid panic --- src/handlers/http/middleware.rs | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/handlers/http/middleware.rs b/src/handlers/http/middleware.rs index cd3797bfb..139463ea4 100644 --- a/src/handlers/http/middleware.rs +++ b/src/handlers/http/middleware.rs @@ -474,6 +474,18 @@ pub async fn refresh_token( }; if let Some(oauth_data) = bearer_to_refresh { + if !oauth_data + .bearer + .as_ref() + .and_then(|bearer| bearer.refresh_token.as_deref()) + .is_some_and(|token| !token.is_empty()) + { + Users.remove_session(key); + return Err(ErrorUnauthorized( + "Your session has expired or is no longer valid. Please re-authenticate to access this resource.", + )); + } + let refreshed_token = match client .read() .await From 40bbf9e598359cf32393c2d39e8cab738c0c66e8 Mon Sep 17 00:00:00 2001 From: Nikhil Sinha Date: Wed, 28 Oct 2026 15:07:12 +0530 Subject: [PATCH 2/2] update message on missing refresh token --- src/handlers/http/middleware.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/handlers/http/middleware.rs b/src/handlers/http/middleware.rs index 139463ea4..13332968d 100644 --- a/src/handlers/http/middleware.rs +++ b/src/handlers/http/middleware.rs @@ -482,7 +482,7 @@ pub async fn refresh_token( { Users.remove_session(key); return Err(ErrorUnauthorized( - "Your session has expired or is no longer valid. Please re-authenticate to access this resource.", + "Your OIDC session cannot be refreshed because the identity provider did not issue a refresh token. Please sign in again and ask your administrator to configure the offline_access scope.", )); }