fix: enable coalesceRefreshTokenExchange to stop invalid_grant storms - #136
Closed
mattzcarey wants to merge 1 commit into
Closed
fix: enable coalesceRefreshTokenExchange to stop invalid_grant storms#136mattzcarey wants to merge 1 commit into
mattzcarey wants to merge 1 commit into
Conversation
Our tokenExchangeCallback redeems a single-use, rotating upstream Cloudflare refresh token, so the refresh_token grant is non-idempotent. When a refresh token is shared across sessions (e.g. two chats) or a client retries a lost response, concurrent/duplicate refreshes race to redeem the same upstream token — one wins, the rest get 'Token refresh failed: 400 invalid_grant', and retries with the previous token re-run the callback and cascade more rotations. Enable the new opt-in coalesceRefreshTokenExchange option in workers-oauth- provider, which single-flights concurrent same-token refreshes within an isolate and replays previous-token retries without re-hitting upstream. Pinned to the pkg.pr.new preview build of cloudflare/workers-oauth-provider#216 for a production soak. Revert this commit (or the dependency pin) to roll back. Made-with: pi
danielbodnar
pushed a commit
to danielbodnar/mcp
that referenced
this pull request
Jun 10, 2026
* feat: add OAuth protected resource metadata (RFC 9728) Add resourceMetadata config to OAuthProvider for the /.well-known/oauth-protected-resource endpoint. Bump workers-oauth-provider to PR cloudflare#136 build which implements the endpoint. * chore: upgrade workers-oauth-provider to PR 143 preview Includes both RFC 9728 changes: - /.well-known/oauth-protected-resource endpoint (cloudflare#136) - resource_metadata in WWW-Authenticate headers (cloudflare#143) * chore: bump workers-oauth-provider to v0.2.4 (released) Replace pkg.pr.new preview build with the released v0.2.4 which includes RFC 9728 support (cloudflare#136, cloudflare#143), RFC 8252 loopback port flexibility for native apps (cloudflare#145), and other fixes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
We see a steady stream of:
Our
tokenExchangeCallbackredeems a single-use, rotating upstream Cloudflare refresh token, so the downstreamrefresh_tokengrant is non-idempotent. Two conditions trigger the errors:invalid_grant.Fix
Enable the new opt-in
coalesceRefreshTokenExchangeoption in@cloudflare/workers-oauth-provider:refresh_tokenrequests for the same token within an isolate are coalesced; the callback (and upstream redemption) runs once and all callers share the response.Provider dependency
Pinned to the pkg.pr.new preview build of cloudflare/workers-oauth-provider#216 (the PR that adds this option) for a production soak:
This will be switched back to a normal semver range once #216 ships.
Rollback
Revert this PR (or just the dependency pin) to return to
^0.6.0with default behaviour. The option is opt-in and changes nothing else.Checks
npm run typecheck✅npm test✅ 183/183npm run format:check✅