I have to set AllowOfflineAccess = true
to get refresh token
public static class Config
{
public static IEnumerable<Client> Clients =>
new Client[]
{
new Client()
{
AllowOfflineAccess = true,
// ....
}
}
}
according to OpenID specification https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
offline_access
OPTIONAL. This scope value requests that an OAuth 2.0 Refresh Token be issued that can be used to obtain an Access Token that grants access to the End-User’s UserInfo Endpoint even when the End-User is not present (not logged in).
I don’t want the “offline” feature, I want “online” feature where users remains login in idp, and when user can still access the resource after the access token expires and then refresh token kicks in. So why obtaining a refresh token has to do with “offline”?