Slack Bolt Python and Token Rotation throws invalid_refresh_token

I have a Bolt app that has token rotation enabled with the following configuration:

oauth_settings = OAuthSettings(
    client_id=...,
    client_secret=...,
    scopes=...,
    user_scopes=...,
    installation_store=FileInstallationStore(base_dir=oauth_config["install_store"]),
    state_store=FileOAuthStateStore(expiration_seconds=600, base_dir=oauth_config["state_store"]),
    token_rotation_expiration_minutes=10
)
app = App(
    signing_secret=oauth_config["signing_secret"],
    oauth_settings=oauth_settings,
)

with the following events being handled: app_home_opened and message. But after a while, some of its users are receiving the following error in the Slack Bolt middleware:

Traceback (most recent call last):
File "/home/ubuntu/slackbot/lib/python3.10/site-packages/slack_bolt/app/app.py", line 509, in dispatch
         resp = middleware.process(req=req, resp=resp, next=middleware_next)
       File "/home/ubuntu/slackbot/lib/python3.10/site-packages/slack_bolt/middleware/authorization/multi_teams_authorization.py", line 58, in process
         auth_result: Optional[AuthorizeResult] = self.authorize(
       File "/home/ubuntu/slackbot/lib/python3.10/site-packages/slack_bolt/authorization/authorize.py", line 220, in __call__
         refreshed = self._rotate_and_save_tokens_if_necessary(
       File "/home/ubuntu/slackbot/lib/python3.10/site-packages/slack_bolt/authorization/authorize.py", line 331, in _rotate_and_save_tokens_if_necessary
         refreshed: Optional[Installation] = self.token_rotator.perform_token_rotation(
       File "/home/ubuntu/slackbot/lib/python3.10/site-packages/slack_sdk/oauth/token_rotation/rotator.py", line 40, in perform_token_rotation
         rotated_bot: Optional[Bot] = self.perform_bot_token_rotation(  # type: ignore
       File "/home/ubuntu/slackbot/lib/python3.10/site-packages/slack_sdk/oauth/token_rotation/rotator.py", line 99, in perform_bot_token_rotation
         raise SlackTokenRotationError(e)
     slack_sdk.errors.SlackTokenRotationError: The request to the Slack API failed. (url: https://www.slack.com/api/oauth.v2.access)
     The server responded with: {'ok': False, 'error': 'invalid_refresh_token'}

The only difference between these users and those not getting these messages are, the former have uninstalled and reinstalled the app a couple of times. From the docs, Bolt handles Token Rotation on its own and there's no other implementation required by devs. Is this correct? If not, what's the correct way to retrieve the correct Refresh tokens during Token Rotation? Any advice helps. Thanks.

@skewwhiff

Hi @skewwhiff, thanks for writing in!

Are you using FileInstallationStore for production apps? If so, the implementation is not scalable and reliable enough for the purpose. Please switch to any of the database/cloud service based options here or your own one.

Also, to safely handle token revocation and uninstallation events, you can add tokens_revoked and app_uninstalled event subscriptions, plus call app.enable_token_revocation_listeners() to enable built-in installation store data handlers for the events. Refer to https://github.com/slackapi/bolt-python/releases/tag/v1.5.0 for more details.

If you see the situation even after applying the above two improvements, please let us know the steps to reproduce your situation and detailed info such bolt-python version and so on.

I hope this was helpful to you.

@seratch

Thanks @seratch . The FileInstallation is just for demo purposes. I looked into enable_token_revocation_listeners docs. It looks like it internally calls tokens_revoked and app_uninstalled. So there's no need to add custom handlers for those events. Is this understanding correct?

Yes, you are right.

Thanks. Closing for now.

Navigation Menu

Repository navigation

Slack Bolt Python and Token Rotation throws invalid_refresh_token #663

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Slack Bolt Python and Token Rotation throws invalid_refresh_token #663

Description

Activity

seratch commented on Jun 1, 2022

skewwhiff commented on Jun 1, 2022

seratch commented on Jun 1, 2022

skewwhiff commented on Jun 1, 2022

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions