How to set different expiry time for access and refresh tokens?
- 主要語言
- Rust
- 星號
- 783
- 分支
- 102
- PR 合併指標
- 30 天內沒有已合併 PR
描述
I'm implementing a server that supports pretty standard Auhorization Code flow. I'd like to generate both access and refresh tokens, the former with short expiry time, the latter with long expiry time. I kinda struggle with how to implement this. Since those tokens are tied one to another, I implemented a single `Issuer` (which I'm using with a `Generic` endpoint). From what I saw in examples and implementation of `TokenMap`, expiry time is taken from `Grant` that is passed to the issuer. This however implies that maybe I should implement different `Issuer` for both access and refresh grants? This however doesn't make sense either since I need to use different - and probably somehow hardcoded - expiry times for both of those tokens. Or perhaps I don't understand where this `Grant` instance comes from when implementing an `Issuer`.
On thing that confuses me on top of this is how to set different access and refresh token expiry times when using `TokenMap`. It seems to me that they are always set to the same expiry time and it cannot be changed.
Maybe this is also related to #117 and I'd be happy to help out with some examples once I understand how to implement this.
貢獻指南
研究方向
查看 Issuer trait 和 TokenMap 實作,以了解目前如何從 Grant 設定過期時間。檢查令牌生成和 Generic 端點周圍的程式碼。目標是允許為存取令牌和重新整理令牌設定單獨的過期時間,可能透過修改 Grant 的處理方式或引入單獨的簽發者來實現。查看 issue #117 以獲取相關背景。
由索引模型根據 Issue 內容生成。
評估
- 領域
- authentication, authorization, backend
- Issue 類型
- 功能
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 活躍度
- 停滯
- 描述清晰度
- 基本清楚
- 新手友好度
- 45/100