Phone Account Requires Re-Login
- Thread starter Klaus-rf
- Start date
-
SUPPORT THE SITE AND ENJOY A PREMIUM EXPERIENCE! Welcome to Tesla Owners Online, four years young! For a low subscription fee, you will receive access to an ad-free version of TOO. We now offer yearly memberships! You can subscribe via this direct link:https://teslaownersonline.com/account/upgrades SUBSCRIBE TO OUR YOUTUBE CHANNEL!Did you know we have a YouTube channel that's all about Tesla? Lots of Tesla information, fun, vlogs, product reviews, and a weekly Tesla Owners Online Podcast as well!
-
It's OK to discuss software issues here but please report bugs to Tesla directly at servicehelpna@teslamotors.com if you want things fixed.
I don't know specifically how the Tesla app works, so take this with a grain of salt, but this is how things like this typically work (this is a simplified explanation):
When you log in to the app, your username and password are sent to the Tesla API server, which validates them and if they are valid returns two tokens (cryptographically signed text usually):
1. A short lived (~30 minutes) "access" token that the app sends with every request it makes to the server and which verifies that the request is valid and coming from you.
2. A longer lived (~2 weeks) "refresh" token that the app uses to ask for a new access token when it expires.
If the app makes a request and the access token has expired, the API will return an error message to the app. The app understands that message and then sends the refresh token with a request for a new access token. The API validates the refresh token, and if it's valid it will issue a new access token (and possibly a new refresh token) and you carry on without having to provide your username and password.
If however, the refresh token has become invalid, you as the user will be asked to log in again.
Refresh tokens become invalid for a variety of reasons: they expire, you change your password, some suspicious activity is detected and they are invalidated programmatically, etc. They can also be lost by the client (e.g. you uninstall the app, or it crashes or for some other reason is not able to access a stored refresh token).
I don't know what Tesla's policy for tokens is or what their logic is for invalidating them, but I would bet that this (or something similar) is what's happening.
When you log in to the app, your username and password are sent to the Tesla API server, which validates them and if they are valid returns two tokens (cryptographically signed text usually):
1. A short lived (~30 minutes) "access" token that the app sends with every request it makes to the server and which verifies that the request is valid and coming from you.
2. A longer lived (~2 weeks) "refresh" token that the app uses to ask for a new access token when it expires.
If the app makes a request and the access token has expired, the API will return an error message to the app. The app understands that message and then sends the refresh token with a request for a new access token. The API validates the refresh token, and if it's valid it will issue a new access token (and possibly a new refresh token) and you carry on without having to provide your username and password.
If however, the refresh token has become invalid, you as the user will be asked to log in again.
Refresh tokens become invalid for a variety of reasons: they expire, you change your password, some suspicious activity is detected and they are invalidated programmatically, etc. They can also be lost by the client (e.g. you uninstall the app, or it crashes or for some other reason is not able to access a stored refresh token).
I don't know what Tesla's policy for tokens is or what their logic is for invalidating them, but I would bet that this (or something similar) is what's happening.
FWIW both my wife and I (who share a Tesla account) have had to log back into the app during the last two weeks (her one week, me the next week).
I think the way the app works (from looking at the API) is that there is an access token that expires after some number of days, and a refresh token that the app can use to automatically generate a new access token without prompting you to log in. If the refresh token expires, or the way it is generated/handled changes, then when your current access token expires, you will need to log in again.
So, if we see a rolling wave of people being asked to log back in over the next month or so (as their access tokens expire), it may just be an indication that the way refresh tokens work has changed.
I think the way the app works (from looking at the API) is that there is an access token that expires after some number of days, and a refresh token that the app can use to automatically generate a new access token without prompting you to log in. If the refresh token expires, or the way it is generated/handled changes, then when your current access token expires, you will need to log in again.
So, if we see a rolling wave of people being asked to log back in over the next month or so (as their access tokens expire), it may just be an indication that the way refresh tokens work has changed.
As a data point my wife and I both have the app logged in under one account. Over the last year we've had the 3, we've had to re login roughly every 4-6 weeks. I didn't keep track because I thought this was working as designed, perhaps a security precaution. Anyhow it has always been this way for us since June last year.