How to set different expiry time for access and refresh tokens?
- Dominant language
- Rust
- Stars
- 783
- Forks
- 102
- PR merge metrics
- No merged PRs in 30d
Description
I'm implementing a server that supports pretty standard Auhorization Code flow. I'd like to generate both access and refresh tokens, the former with short expiry time, the latter with long expiry time. I kinda struggle with how to implement this. Since those tokens are tied one to another, I implemented a single `Issuer` (which I'm using with a `Generic` endpoint). From what I saw in examples and implementation of `TokenMap`, expiry time is taken from `Grant` that is passed to the issuer. This however implies that maybe I should implement different `Issuer` for both access and refresh grants? This however doesn't make sense either since I need to use different - and probably somehow hardcoded - expiry times for both of those tokens. Or perhaps I don't understand where this `Grant` instance comes from when implementing an `Issuer`.
On thing that confuses me on top of this is how to set different access and refresh token expiry times when using `TokenMap`. It seems to me that they are always set to the same expiry time and it cannot be changed.
Maybe this is also related to #117 and I'd be happy to help out with some examples once I understand how to implement this.
Contributor guide
Assessment
This issue has not been assessed yet.