Dojo API: /auth/refresh throws error when refreshToken is supplied in request body about samourai-dojo

[pajasevi]

I think what might be the issue: along with refresh token in request body, there was also access token present in request header using Bearer scheme.

[LaurentMT]

Your observation is correct. If the request has an "Authorization" header, the /auth/refresh endpoint expects that this header stores the refresh token, not the authentication token (that is not required by this endpoint).

[pajasevi]

Well, this behavior seems kinda non-standard to me.
Standard behavior would be calling the refresh endpoint with refresh token in request body and access token in Authorization header - and this endpoint should return both new access token and new refresh token.

[LaurentMT]

The Access Token isn't required (nor expected) by the /auth/refresh endpoint (see https://github.com/Samourai-Wallet/samourai-dojo/blob/develop/doc/POST_auth_refresh.md)

The idea is that when the user authenticates to Dojo, it receives an Access Token (valid for 15 mn) and a Refresh Token (valid for 120 mn).

The /auth/refresh endpoint allows to generate a new valid Access Token (even if the previous one has expired). The only requirement is that the Refresh Token is still valid. Generation of a new Refresh Token can only be done by a new manual authentication.

[pajasevi]

Okay, thanks for clearing that out 👍