Microsoft OAuth2技术问题：无法通过Refresh Token获取Access Token

我尝试使用Client ID和Client Secret，通过用户的Refresh Token代用户获取Access Token，但偶尔会收到400 Bad Request错误，错误提示：

Public clients can't send a client secret

操作流程 #

• 引导用户登录并获取Auth Code；
• 使用该Code调用Token API，设置grant_type为authorization_code，成功获取Access Token和Refresh Token；
• 后续调用Token API时设置grant_type为refresh_token，尝试刷新Access Token，此时出现上述错误。

相关API调用代码 #

1. 通过Auth Code获取Access Token和Refresh Token

var myHeaders = new Headers();
myHeaders.append("Content-Type", "application/x-www-form-urlencoded");

var urlencoded = new URLSearchParams();
urlencoded.append("client_id", XXXX);
urlencoded.append("scope", "user.read openid profile offline_access");
urlencoded.append("redirect_uri", XXXX);
urlencoded.append("grant_type", "authorization_code");
urlencoded.append("client_secret", XXXX);
urlencoded.append("code", XXXX);

var requestOptions = {
  method: 'POST',
  headers: myHeaders,
  body: urlencoded,
  redirect: 'follow'
};

fetch("https://login.microsoftonline.com/common/oauth2/v2.0/token", requestOptions)
  .then(response => response.text())
  .then(result => console.log(result))
  .catch(error => console.log('error', error));

2. 刷新Access Token的API调用

var myHeaders = new Headers();
myHeaders.append("Content-Type", "application/x-www-form-urlencoded");

var urlencoded = new URLSearchParams();
urlencoded.append("client_id", XXXX);
urlencoded.append("scope", "user.read openid profile offline_access");
urlencoded.append("redirect_uri", XXXX);
urlencoded.append("grant_type", "refresh_token");
urlencoded.append("client_secret", XXXX);
urlencoded.append("refresh_token", XXXX);

var requestOptions = {
  method: 'POST',
  headers: myHeaders,
  body: urlencoded,
  redirect: 'follow'
};

fetch("https://login.microsoftonline.com/common/oauth2/v2.0/token", requestOptions)
  .then(response => response.text())
  .then(result => console.log(result))
  .catch(error => console.log('error', error));

Azure AD认证配置截图 #

内容的提问来源于stack exchange，提问作者Abhishek