OAuth2 Authorization code was already redeemed

Question

AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token. Trace ID: 46d60227-a196-4a10-96b1-dff84a843400 Correlation ID: 8d6ce73f-e8b1-4630-a75f-61d8f30eeb93 Timestamp: 2021-03-12 08:28:33Z my web app has been working fine for 2 years. It's not working now. this is my code

url = "https://login.microsoftonline.com/{TID}/oauth2/token".format( TID=MYTID, )
data = requests.post(url, data={ 'client_id': CLIENT_ID, 'client_secret': my_secrete, 'code': token, 'grant_type': 'authorization_code', "redirect_uri": REDIRECT_URI, 'resource': APPID_URI, })
return data.json()

does any one have any idea about this?

Answer 1

Hello @Huang Chao ,

This behavior is to be expected when your application reuses authorization codes to get tokens. I would recommend you to revisit your code and see if your application reuses code.

If your app reuses authorization codes to get tokens for multiple resources, we recommend that you use the code to get a refresh token, and then use that refresh token to acquire additional tokens for other resources. Authorization codes can only be used once, but refresh tokens can be used multiple times across multiple resources. Any new app that attempts to reuse an authentication code during the OAuth code flow will get an invalid_grant error AADSTS54005: OAuth2 Authorization code was already redeemed.

For more information, read this (article](https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-breaking-changes#authorization-codes-can-no-longer-be-reused)

Regards,
Siva Kumar Selvaraj

Answer 2

Hi, same problem here. Same ASP NET 6.0 web app running for months without any login problem, and for the last couple of months everytime I update the app from VisualStudio, some users (not all, and not always) get this error. I can't find a solution to it, and normally if goes away after recycling the Wep app in Azure.

Any clues?

Answer 3

So what we do we "refresh" accesstokens?