Users getting logged out with "Unsuccessful Refresh Token exchange, reused refresh token detected"

[LA-Johan]

Checklist

• The issue can be reproduced in the auth0-react sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

Our usage of Auth0 is pretty simple. After the user has been logged in we just attach the access token to network calls and verify them server side.

const useApi = (): Api => {
  const { getAccessTokenSilently } = useAuth0()
  const backend = axios.create({ baseURL: apiUri, timeout: 10000 })
  backend.interceptors.request.use(
    async config => {
      const accessToken = await getAccessTokenSilently()
      config.headers["Authorization"] = `Bearer ${accessToken}`
      return config
    },

    async error => {}
  )
}  

We have gotten user reports that they get error in title. Our understanding is that this error is unrecoverable so we log the user out and force them to re-authenticate. We have a couple of thousand weekly users and this happens to maybe 2% of them.

One log id as an example:
90020251109193144192993000000000000001223372093304300940

Our top level provider:

 <Auth0Provider
        key={`${domain}-${clientId}-${audience}`} // This forces remount when values change
        domain={domain}
        clientId={clientId}
        authorizationParams={{
          redirect_uri: getFrontEndHost(),
          audience: audience,
        }}
        cacheLocation={"localstorage"}
        onRedirectCallback={onAuth0Redirect}
        useRefreshTokens={true}
      >
        <AppWithTheme />
</Auth0Provider>

Reproduction

Seems to happen randomly, a few times a week for affected users. Mostly on iOS and MacOS devices but we've also seen it happen on Windows machines.

Additional context

A similar issue happens when we use the react native version, but only for iOS devices. We allow overlap for expiring refresh tokens (120 seconds). Our refresh token are set to last one year, and we're currently seeing this multiple times a week for users.

auth0-react version

2.8.0

React version

19.1.0

Which browsers have you tested in?

Chrome, Safari

[gyaneshgouraw-okta]

Hey @LA-Johan , i am reviewing the issue. Once we have more updates, we will notify you.

[francosomosfin]

Hi @gyaneshgouraw-okta

We are facing the same issue described by @LA-Johan .

We have a very simple Auth0 integration, and we get this error randomly several times a week, sometimes affecting the same user more than once a month.

We have a web application, and in addition to that, we use Capacitor to build our iOS and Android native apps. In the native apps, we use a custom cache that relies on iOS Keychain and Android SharedPreferences for storing tokens. In the web app, we use localStorage. The error occurs both in the web and the native apps as well.

Nothing we’ve tried in the last few months has worked:

• We have a refresh token lifetime of 1 year, without idle refresh token expiration
• Rotation overlap period of 30 seconds
• Upgrading the Auth0 client to the latest version (2.11.0)
• Wrapping the getAccessTokenSilently call in an async-lock block to avoid potential concurrency issues
• Even adding a small delay before calling getAccessTokenSilently

[gyaneshgouraw-okta]

We’ve recently released a fix in the underlying base library used by this SDK that addresses issues related to reused refresh tokens: auth0/auth0-spa-js#1503

This fix will be included in an upcoming release of the auth0-react SDK as well.

It’s worth noting that reused refresh token issues can have multiple root causes, ranging from tenant configuration to how a client structures its refresh token logic. The PR linked above specifically addresses scope-related issues that could lead to refresh token reuse.

Once the fix is shipped in the auth0-react SDK, I’ll follow up with an update here.

[LA-Johan]

@gyaneshgouraw-okta reading through the PR, would that fix the issue we're facing? Looking at our code we don't change the scope dynamically, it's always the same.

[yogeshchoudhary147]

Hey @LA-Johan and @francosomosfin,

We've just released auth0-react v2.14.0 (with auth0-spa-js v2.15.0) which includes fixes for refresh token reuse issues:

1. Refresh token synchronization (#1503) - Ensures refresh tokens are properly synced across cache entries during rotation
2. Token expiration preservation (#1529) - Prevents expired tokens from being served after rotation

Could you upgrade to v2.14.0 and let us know if the issue persists?

If the issue continues, please share any patterns you notice in the Auth0 logs (timing, user actions, etc.) to help us investigate further.

[yogeshchoudhary147]

Hi @LA-Johan, following up on the above. Please let us know if upgrading to v2.14.0 resolved the issue for you. If it still persists, sharing any relevant patterns from your Auth0 logs like error codes and timing between requests would help us investigate further.

[LA-Johan]

@yogeshchoudhary147 this issue is still happening as of 2.15.0. Error code ferrt. We see a similar issue using the react native package on mobile, though there the error is usually combined with a Token could not be decoded or is missing in DB error code fertft, which we don't see on web. You can see discussion on the mobile issue here.

We have not noticed any particular patterns or timing of this happening other than it being pretty rare, but since our implementation is barebones you might have better logging of our tenant than we do, feel free to access to debug.

Edit: I can't say that this is true for all of our users but anecdotally it seems to happen on page launch / app launch.

[LA-Johan]

@yogeshchoudhary147 we seem to be seeing a big uptick of these in the last couple of hours despite no changes or releases on our end.

[francosomosfin]

@yogeshchoudhary147 @LA-Johan we are experiencing a lot of these errors in the last 4 hours aprox

[francosomosfin]

Before that, the error was still happening

[LA-Johan]

As this elevation is happening in our mobile app too I would urge you to look at any shared backend they used, I don't think it's a platform specific issue.

[LA-Johan]

The elevated errors were apparently related to this incident. We're back down to our normal level of errors.