Refreshed auth token not persisting - sonos

Question

We seem to be encountering an issue where we are refreshing auth tokens via a fault as described in the "REFRESHING EXPIRED TOKENS USING A SOAP FAULT" section of the "Processing authentication tokens" page. Sonos is receiving the new token and using it to fulfill its original request, but is then reverting back to using the old token information.
We captured some traffic showing the problem and have been able to reproduce it several times.
First, Sonos makes a request using an expired token:
POST /soap HTTP/1.1
Connection: Keep-Alive
Content-Type: text/xml; charset="utf-8"
Accept-Encoding: gzip
Accept-Language: en-US
Host: <our_service>
Max-Forwards: 10
User-Agent: Linux UPnP/1.0 Sonos/52.13-69030 (ICRU_iPhone11,8)
X-Sonos-Controller-ID: 02A4****
X-Sonos-Api-Key: 4348****
X-Sonos-Corr-Id: c27c47ca-50c7-4a45-8c77-12c6b6a4415c
SOAPACTION: "http://www.sonos.com/Services/1.1#getMetadata"
X-FORWARDED-PROTO: https
X-FORWARDED-PORT: 443
X-ORIGINAL-HOST: <our_service>
X-Original-URL: /soap
X-Forwarded-For: ****
X-ARR-SSL: ****
X-ARR-LOG-ID: 203a446d-76ec-498d-b72d-ad8e61a0611e
Content-Length: 803
<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Header>
<context xmlns="http://www.sonos.com/Services/1.1">
<timeZone>-4:00</timeZone>
</context>
<credentials xmlns="http://www.sonos.com/Services/1.1">
<loginToken>
<token>95ce****</token>
<key>{"Expires":"2019-09-24T18:33:58.7093084Z","RefreshToken":"ceaa****"}</key>
<householdId>Sonos_sIGui81Pzu6Jny5L0ELN0WnJsG</householdId>
</loginToken>
<deviceId>78-28-CA-03-DA-40:B</deviceId>
<deviceProvider>Sonos</deviceProvider>
</credentials>
</s:Header>
<s:Body>
<getMetadata xmlns="http://www.sonos.com/Services/1.1">
<id>root</id>
<index>0</index>
<count>100</count>
</getMetadata>
</s:Body>
</s:Envelope>
Our service recognizes the token as expired and refreshes it:
HTTP/1.1 500 Internal Server Error
Content-Type: text/xml; charset="utf-8"
Server: Microsoft-IIS/10.0
Date: Wed, 25 Sep 2019 13:45:39 GMT
Content-Length: 554
<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Body>
<s:Fault>
<faultcode>Client.TokenRefreshRequired</faultcode>
<faultstring>Auth Token Refreshed</faultstring>
<detail>
<refreshAuthTokenResult xmlns="http://www.sonos.com/Services/1.1">
<authToken>d464****</authToken>
<privateKey>{"Expires":"2019-09-25T14:45:39.2925349Z","RefreshToken":"a0ab****"}</privateKey>
</refreshAuthTokenResult>
</detail>
</s:Fault>
</s:Body>
</s:Envelope>
Sonos receives the new token, and uses it to fulfill its original request:
POST /soap HTTP/1.1
Connection: Keep-Alive
Content-Type: text/xml; charset="utf-8"
Accept-Encoding: gzip
Accept-Language: en-US
Host: <our_service>
Max-Forwards: 10
User-Agent: Linux UPnP/1.0 Sonos/52.13-69030 (ICRU_iPhone11,8)
X-Sonos-Controller-ID: 02A4****
X-Sonos-Api-Key: 4348****
X-Sonos-Corr-Id: 6f050fc0-027a-410c-8315-bf22486140a7
SOAPACTION: "http://www.sonos.com/Services/1.1#getMetadata"
X-FORWARDED-PROTO: https
X-FORWARDED-PORT: 443
X-ORIGINAL-HOST: <our_service>
X-Original-URL: /soap
X-Forwarded-For: ****
X-ARR-SSL: ****
X-ARR-LOG-ID: 745f02ac-60c7-440f-9c0c-620b73905b39
Content-Length: 803
<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Header>
<context xmlns="http://www.sonos.com/Services/1.1">
<timeZone>-4:00</timeZone>
</context>
<credentials xmlns="http://www.sonos.com/Services/1.1">
<loginToken>
<token>d464****</token>
<key>{"Expires":"2019-09-25T14:45:39.2925349Z","RefreshToken":"a0ab****"}</key>
<householdId>Sonos_sIGui81Pzu6Jny5L0ELN0WnJsG</householdId>
</loginToken>
<deviceId>78-28-CA-03-DA-40:B</deviceId>
<deviceProvider>Sonos</deviceProvider>
</credentials>
</s:Header>
<s:Body>
<getMetadata xmlns="http://www.sonos.com/Services/1.1">
<id>root</id>
<index>0</index>
<count>100</count>
</getMetadata>
</s:Body>
</s:Envelope>
The new token is good, so we respond with information:
HTTP/1.1 200 OK
Content-Type: text/xml; charset="utf-8"
Server: Microsoft-IIS/10.0
Date: Wed, 25 Sep 2019 13:45:41 GMT
Content-Length: 4408
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Body>
<getMetadataResponse xmlns="http://www.sonos.com/Services/1.1">
<getMetadataResult xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<index>0</index>
<count>1</count>
<total>1</total>
<mediaCollection>
DATA
</mediaCollection>
</getMetadataResult>
</getMetadataResponse>
</s:Body>
</s:Envelope>
Everything is working as expected that far. But then when Sonos tries to make another request, it's reverting to using the old authentication information:
POST /soap HTTP/1.1
Connection: Keep-Alive
Content-Type: text/xml; charset="utf-8"
Accept-Encoding: gzip
Host: <our_service>
Max-Forwards: 10
User-Agent: Linux UPnP/1.0 Sonos/52.13-69030 (ZPS13)
X-Sonos-Corr-Id: 813f189e-8a70-41c2-8aaa-c1b117f6045d
SOAPACTION: "http://www.sonos.com/Services/1.1#getMetadata"
X-FORWARDED-PROTO: https
X-FORWARDED-PORT: 443
X-ORIGINAL-HOST: <our_service>
X-Original-URL: /soap
X-Forwarded-For: ****
X-ARR-SSL: ****
X-ARR-LOG-ID: 1158ddfa-df17-4f37-8843-1133566dacbe
Content-Length: 855
<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Header>
<credentials xmlns="http://www.sonos.com/Services/1.1">
<deviceId>78-28-CA-03-DA-40:B</deviceId>
<deviceProvider>Sonos</deviceProvider>
<loginToken>
<token>95ce****</token>
<key>{"Expires":"2019-09-24T18:33:58.7093084Z","RefreshToken":"ceaa****"}</key>
<householdId>Sonos_sIGui81Pzu6Jny5L0ELN0WnJsG</householdId>
</loginToken>
</credentials>
<context xmlns="http://www.sonos.com/Services/1.1">
<timeZone>-4:00</timeZone>
</context>
</s:Header>
<s:Body>
<getMetadata xmlns="http://www.sonos.com/Services/1.1">
<id>audiobook:18789269:791128</id>
<index>0</index>
<count>2147483647</count>
<recursive>1</recursive>
</getMetadata>
</s:Body>
</s:Envelope>
That token is still expired, and that refresh token has now been used already and discarded, so we respond saying the user must re-authenticate:
HTTP/1.1 500 Internal Server Error
Content-Type: text/xml; charset="utf-8"
Server: Microsoft-IIS/10.0
Date: Wed, 25 Sep 2019 13:45:43 GMT
Content-Length: 213
<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Body>
<s:Fault>
<faultcode>Client.AuthTokenExpired</faultcode>
<faultstring>Error refreshing auth token</faultstring>
</s:Fault>
</s:Body>
</s:Envelope>
We're not sure what's going wrong, as Sonos appears to be recognizing our refresh response and uses the new information the first time. Is there something we need to do differently?

Answer 1

The first request comes from the Sonos app (indicated by ICRU_iPhone11,8 in the user-agent). Your service sends new credentials to the app and the app updates them and makes a request with them.
The next request is from a Sonos player in the household (ZPS13 in the user-agent). The Sonos player does not have the new authentication information as the Sonos app does not replicate new credentials to the players. In this case, you should handle multiple token refreshes using the same refresh token. Once the player receives new credentials, it propagates them to other players and apps.
If the first request had come from a Sonos player, the player would event out new credentials to other players and apps.
I'll update the Processing Authentication Tokens for API Requests documentation with this information.