Permission error accessing /.auth/refresh

Question

I'm using Azure App Service with authentication using Google and Microsoft account. I can access mysite/.auth/me, without an issue upon login in. But to refresh token, /.auth/refresh is returning me following exception.

You do not have permission to view this directory or page.

Not sure what access to be granted here in Azure blade.

Answer 1

The error message is actually a bit misleading. It's not that you don't have permission to access the API, but rather there are probably no refresh tokens in your token store. The way to acquire refresh tokens during user login is a little different for each provider. More details here:

https://cgillum.tech/2016/03/07/app-service-token-store/

In order for this to work, the token store must contain refresh tokens for your provider. If you’re not familiar with how to do this, here are some hints:

• Google: Append an "access_type=offline" query string parameter to your /.auth/login API call (if using the Mobile Apps SDK, you can add this to one of the LogicAsync overloads).
• Microsoft Account: Select the wl.offline_access scope in the Azure management portal.
• Azure AD: This is a little complex right now, but take a look at my next post on enabling Graph API access. Follow the setup steps and this will also enable you to get refresh tokens for Azure AD (you can omit the Read directory data and the resource=… parts if they don’t apply to you). The plan is to simplify this in the future.