refreshToken expiration causing 400 error on secure routes instead of redirecting

[MaximumCrash]

Hi I was guided here by Andrea Skouras on the Support Engineering side.

Expected Behavior

• When using scopes with offline_access and a defined refreshToken on our React app (using the okta-react 5.1.1) I expect the app to redirect the user to the okta sign in widget on secure routes when the user's token expires.

What's Happening

• When the refreshToken expires and the user lands on a secure route we get a 400 response error from the token endpoint. (Specifically that our tokens aren't valid.)

Upon further investigation we discovered that the tokenManager isn't being cleared when a refresh is necessary.

[oleksandrpravosudko-okta]

Thanks for the report @MaximumCrash.

Internal ref: OKTA-400565

[shuowu]

Fixed in v5.2.1