197g / 197g/oxide-auth

How to set different expiry time for access and refresh tokens?

Open
#141 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
783
Forks
102
PR merge metrics
No merged PRs in 30d

Description

I'm implementing a server that supports pretty standard Auhorization Code flow. I'd like to generate both access and refresh tokens, the former with short expiry time, the latter with long expiry time. I kinda struggle with how to implement this. Since those tokens are tied one to another, I implemented a single `Issuer` (which I'm using with a `Generic` endpoint). From what I saw in examples and implementation of `TokenMap`, expiry time is taken from `Grant` that is passed to the issuer. This however implies that maybe I should implement different `Issuer` for both access and refresh grants? This however doesn't make sense either since I need to use different - and probably somehow hardcoded - expiry times for both of those tokens. Or perhaps I don't understand where this `Grant` instance comes from when implementing an `Issuer`.

On thing that confuses me on top of this is how to set different access and refresh token expiry times when using `TokenMap`. It seems to me that they are always set to the same expiry time and it cannot be changed.

Maybe this is also related to #117 and I'd be happy to help out with some examples once I understand how to implement this.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.