AccountManager: invalidateAuthToken does not cancel the token

Question

I am trying to get a new token from a Google account stored on an Android device, but all I have is the same old token that I cached in recent days. It seems that it is cached somewhere on the phone, and even the Internet request is not sent (I did a test in the application without an Internet connection, and the same token is returned).

I used the invalidateAuthToken method before getting a new one with getResult from AccountManagerFuture . Look here please:

 public String updateToken(Activity activity) throws Exception { AccountManager am = AccountManager.get(activity); Account[] accounts = am.getAccountsByType("com.google"); if (accounts == null || accounts.length == 0 || "".equals(accounts[0].name.trim())) { throw new Exception("Não há contas Google configuradas no smartphone."); } else if (!" [e-mail] ".equals(accounts[0].name.trim()) && !" [e-mail] ".equals(accounts[0].name.trim()) && !" [e-mail] ".equals(accounts[0].name.trim())) { Log.w("Util.updateToken","conta obtida: " + accounts[0].name); throw new Exception("Conta Google não autorizada."); } Log.w("Util.updateToken","conta obtida: " + accounts[0].name); am.invalidateAuthToken("com.google", null); Log.w("Util.updateToken","Passou do invalidateAuthToken"); AccountManagerFuture<Bundle> future = am.getAuthToken(accounts[0], "ah", null, activity, null, null); Log.w("Util.updateToken","Passou do getAuthToken"); Bundle bundle = future.getResult(); Log.w("Util.updateToken","Passou do getResult"); future = null; am = null; accounts = null; String authToken = bundle.getString(AccountManager.KEY_AUTHTOKEN); Log.w("Util.updateToken","Token: " + authToken); return authToken; } 

A thread called this method from the Util class an instance of singleton. The manifest has all the necessary permissions. Does anyone have an idea why the token is not being updated?

Answer 1

To invalidate an authentication token, you need to pass the token you want to invalidate as the second argument to invalidateAuthToken. See Section “4.4.3 Invalid Authentication Token” on this blog post . The video on this page is also useful.

The documentation for invalidateAuthToken mentions that the second argument can be null, but that only means that it allowed to call this method with null, and not that every cached token is invalid if null is passed.

If you do something like this, your code should work instead:

 // Get token AccountManagerFuture<Bundle> future = am.getAuthToken(accounts[0], "ah", null, activity, null, null); Bundle bundle = future.getResult(); String authToken = bundle.getString(AccountManager.KEY_AUTHTOKEN); // invalidate the token since it may have expired. am.invalidateAuthToken("com.google", authToken); // Get token again future = am.getAuthToken(accounts[0], "ah", null, activity, null, null); bundle = future.getResult(); authToken = bundle.getString(AccountManager.KEY_AUTHTOKEN); 

Answer 2

It’s easier to just “peek” at the current cached token, check if it is valid, and create a new one if necessary.

 String authToken = accountManager.peekAuthToken(account, Constants.AUTHTOKEN_TYPE); // validate the token, invalidate and generate a new one if required accountManager.invalidateAuthToken(Constants.ACCOUNT_TYPE, authToken); accountManager.blockingGetAuthToken(account, Constants.AUTHTOKEN_TYPE, NOTIFY_AUTH_FAILURE);