Unexpected access token type: bearer - should be one of 'DPoP' or 'Bearer''

[qq1176914912]

I use dex combined with BFF project, when I was in BFF project after the refresh token using the following methods:

var parameters = new UserTokenRequestParameters { ForceRenewal = true };  
var token = await IUserTokenManagementService.GetAccessTokenAsync(HttpContext.User, parameters);

An error message will appear: Unexpected access token type: bearer - should be one of 'DPoP' or 'Bearer'
May I ask if there are any solutions?

[maartenba]

Related: dexidp/dex#4237

[maartenba]

@qq1176914912 Which version of BFF / Duende.AccessTokenManagement are you using? Also would you have any logs from your Dex server? And lastly, which federated provider are you using with this token?

[qq1176914912]

@qq1176914912 Which version of BFF / Duende.AccessTokenManagement are you using? Also would you have any logs from your Dex server? And lastly, which federated provider are you using with this token?

Hi, hello! This is my version：

Just as this question mentions: dexidp/dex#4237, after I changed these lowercase letters in the dex to uppercase, this problem won't occur. As for why I'm still asking you this question, it's because I'm not sure where the changes I made in the dex project will affect it or if there will be any issues. Also, I noticed that the responses to dex questions are very slow, and no one has replied for a long time. That's why I'm asking you here if BFF has any solutions for this situation. If not for now, then I'll wait for dex's reply. You can turn off this question.

[maartenba]

We found the root cause: in BFF v2, 3.0 and 3.1, the token type is case-sensitive (where the spec says it should be case-insensitive). Relevant method from 3.0:

https://github.com/DuendeSoftware/products/blob/bff-3.0.0/bff/src/Bff/Extensions/HttpContextExtensions.cs#L45 (and https://github.com/DuendeSoftware/products/blob/releases/bff/3.1.0/bff/src/Bff/Extensions/HttpContextExtensions.cs#L45)

We'll discuss this internally.

Your current change in Dex is probably a good workaround for the time being.

[qq1176914912]

We found the root cause: in BFF v2, 3.0 and 3.1, the token type is case-sensitive (where the spec says it should be case-insensitive). Relevant method from 3.0:

https://github.com/DuendeSoftware/products/blob/bff-3.0.0/bff/src/Bff/Extensions/HttpContextExtensions.cs#L45 (and https://github.com/DuendeSoftware/products/blob/releases/bff/3.1.0/bff/src/Bff/Extensions/HttpContextExtensions.cs#L45)

We'll discuss this internally.

Your current change in Dex is probably a good workaround for the time being.

Thank you for your prompt reply. Currently, the most stable version of Duende.BFF on nuget is 3.0.0. Do you plan to solve this issue in the next version? If so, then we look forward to your next version.
If this question can be closed, I will close it.

[maartenba]

In BFF v4 (currently in prerelease version), this issue has been solved. A release candidate should be out very soon.
An upgrade guide is at https://docs.duendesoftware.com/bff/upgrading/bff-v3-to-v4/

[qq1176914912]

In v4 (currently in prerelease version), this issue has been solved. A release candidate should be out very soon. An upgrade guide is at https://docs.duendesoftware.com/bff/upgrading/bff-v3-to-v4/

Understood. Thank you for your reply

[maartenba]

Just discussed with the engineering team, we will do a fix for previous versions as well. This will go in the next minor versions of v3 (and v2), to be released in the coming weeks.