ASP.NET MVC集成Google Calendar API令牌过期无法刷新及永久令牌设置咨询

我在ASP.NET MVC应用中集成Google Calendar API时遇到了一个问题：本地运行代码完全正常，但部署到服务器后就抛出错误：The access token has expired and could not be refreshed. Errors: refresh error, refresh error, refresh error。

相关代码如下：

Index 方法 #

public async Task<ActionResult> Index() {
    var userId = User.Identity.GetUserId();
    var _User = "Usr" + userId;
    string credPath = Server.MapPath($"~/UsersToken/{_User}");
    UserCredential UsrCred = null;
    FileDataStore fileStore = new FileDataStore(credPath);
    TokenResponse tokenResponse = await fileStore.GetAsync<TokenResponse>(userId);
    if (!Directory.Exists(credPath)) {
        Directory.CreateDirectory(credPath);
    }
    DirectoryInfo info = new DirectoryInfo(credPath);
    DirectorySecurity security = info.GetAccessControl();
    security.AddAccessRule(new FileSystemAccessRule("Users", FileSystemRights.FullControl, AccessControlType.Allow));
    info.SetAccessControl(security);
    if (tokenResponse == null) {
        var result = new AuthorizationCodeMvcApp(this, new AppFlowMetadata()).AuthorizeAsync(CancellationToken.None);
        if (result.Result.Credential == null)
            return Redirect(result.Result.RedirectUri);
        else {
            UsrCred = result.Result.Credential;
        }
    } else {
        IAuthorizationCodeFlow flow = new GoogleAuthorizationCodeFlow(new GoogleAuthorizationCodeFlow.Initializer {
            ClientSecrets = new ClientSecrets {
                ClientId = _clientId,
                ClientSecret = _clientSecret
            },
            Scopes = Scopes,
            DataStore = new FileDataStore(credPath, true)
        });
        UsrCred = new UserCredential(flow, userId, tokenResponse);
    }
    var service = new CalendarService(new BaseClientService.Initializer() {
        HttpClientInitializer = UsrCred,
        ApplicationName = ApplicationName,
    });
    EventsResource.ListRequest request = service.Events.List("primary");
    request.TimeMin = DateTime.Now;
    request.ShowDeleted = false;
    request.SingleEvents = true;
    request.OrderBy = EventsResource.ListRequest.OrderByEnum.StartTime;
    Events events = request.Execute();
    List<EventModel> Result = new List<EventModel>();
    if (events.Items != null && events.Items.Count > 0) {
        foreach (var eventItem in events.Items) {
            Result.Add(
                new EventModel() {
                    Sumarry = eventItem.Summary,
                    Description = eventItem.Description,
                    StartDate = eventItem.Start.DateTime,
                    EndDate = eventItem.End.DateTime,
                    GoogleMeetLink = eventItem.HangoutLink
                }
            );
        }
    }
    return View(Result);
}

重定向方法（IndexAsync） #

public async Task<ActionResult> IndexAsyc(string state, string code, string scope) {
    string Lang = ViewBag.Lang ?? "ar";
    string RedirectURL = HttpContext.Request.Url.GetLeftPart(UriPartial.Authority) + $"/{Lang}/Meetings/IndexAsyc";
    var userId = User.Identity.GetUserId();
    var _User = "Usr" + userId;
    string credPath = Server.MapPath($"~/UsersToken/{_User}");
    UserCredential UsrCred = null;
    FileDataStore fileStore = new FileDataStore(credPath);
    TokenResponse tokenResponse = await fileStore.GetAsync<TokenResponse>(userId);
    GoogleAuthorizationCodeFlow authorizationCodeFlow = new GoogleAuthorizationCodeFlow(new GoogleAuthorizationCodeFlow.Initializer {
        DataStore = new FileDataStore(credPath),
        ClientSecrets = new ClientSecrets() {
            ClientId = _clientId,
            ClientSecret = _clientSecret
        },
        Scopes = Scopes
    });
    if (tokenResponse == null) {
        tokenResponse = await authorizationCodeFlow.ExchangeCodeForTokenAsync(
            userId,
            code,
            RedirectURL,
            CancellationToken.None);
    }
    TokenResponse tokenResponse2 = await fileStore.GetAsync<TokenResponse>(userId);
    if (tokenResponse2 != null) {
        return RedirectToAction("Index");
    }
    var Creds = new UserCredential(authorizationCodeFlow, userId, tokenResponse2);
    if (Creds != null) {
        var service = new CalendarService(new BaseClientService.Initializer() {
            HttpClientInitializer = Creds,
            ApplicationName = ApplicationName,
        });
        return RedirectToAction("Index");
    } else {
        return new RedirectResult(RedirectURL);
    }
}

解决方案：没有真正“永不过期”的令牌，但我们可以通过以下步骤彻底解决刷新失败问题 #

首先要明确：Google OAuth的刷新令牌虽然长期有效，但也可能因用户操作（如撤销权限）或Google的安全策略失效，不过我们可以优化逻辑让令牌自动刷新，同时解决服务器环境的问题：

• 检查服务器文件权限
  你的代码里给Users组分配了权限，但服务器上ASP.NET应用通常以IIS应用池身份（比如IIS AppPool\YourAppPoolName）运行，而非普通用户。要确保这个应用池身份对~/UsersToken/{_User}目录有完整的读写权限——如果令牌文件无法被更新，刷新时就会读取到过期的令牌，导致报错。直接给应用池身份分配权限比给Users组更准确安全。

• 修复令牌刷新逻辑，让Google库自动处理
  你当前手动实例化UserCredential的方式，没有触发Google库内置的自动刷新机制。修改Index方法中tokenResponse存在时的逻辑：

  else {
      IAuthorizationCodeFlow flow = new GoogleAuthorizationCodeFlow(new GoogleAuthorizationCodeFlow.Initializer {
          ClientSecrets = new ClientSecrets {
              ClientId = _clientId,
              ClientSecret = _clientSecret
          },
          Scopes = Scopes,
          DataStore = new FileDataStore(credPath, true)
      });
      // 用LoadTokenAsync获取凭证，它会自动检测令牌是否过期并尝试刷新
      UsrCred = await flow.LoadTokenAsync(userId, CancellationToken.None);
      
      // 额外校验：如果凭证无效或即将过期，重新引导用户授权
      if (UsrCred == null || UsrCred.Token.IsExpired(TimeSpan.FromMinutes(5))) {
          var result = await new AuthorizationCodeMvcApp(this, new AppFlowMetadata()).AuthorizeAsync(CancellationToken.None);
          if (result.Credential == null)
              return Redirect(result.RedirectUri);
          else {
              UsrCred = result.Credential;
          }
      }
  }
  

  这样Google的客户端库会自动处理令牌刷新，无需手动干预。

• 确认重定向URI配置完全一致
  在Google Cloud Console的OAuth 2.0客户端ID设置中，重定向URI必须和服务器上生成的RedirectURL完全匹配——包括HTTP/HTTPS、域名、路径，哪怕一个字符不同都会导致授权或刷新失败。建议把本地测试和服务器的URI分开配置。

• 验证令牌存储的有效性
  检查服务器上~/UsersToken/{_User}目录是否生成了令牌文件。如果没有，说明授权过程中令牌没有被正确写入，要排查路径是否正确、权限是否足够。可以在代码中添加日志，记录令牌存储的路径和操作结果，方便定位问题。

• “永不过期”的替代方案
  如果你的应用不需要用户交互（比如后台同步日历数据），可以考虑使用Google服务账号替代OAuth授权码流程。服务账号可以生成长期有效的令牌（只要密钥不泄露），适合非用户驱动的操作。但如果必须访问用户个人日历，还是得依赖OAuth流程，这时靠正确的刷新逻辑就能维持令牌有效。

内容的提问来源于stack exchange，提问作者Omar Seleim