197g / 197g/oxide-auth

How to set different expiry time for access and refresh tokens?

未關閉
#141 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Rust
星號
783
分支
102
PR 合併指標
30 天內沒有已合併 PR

描述

I'm implementing a server that supports pretty standard Auhorization Code flow. I'd like to generate both access and refresh tokens, the former with short expiry time, the latter with long expiry time. I kinda struggle with how to implement this. Since those tokens are tied one to another, I implemented a single `Issuer` (which I'm using with a `Generic` endpoint). From what I saw in examples and implementation of `TokenMap`, expiry time is taken from `Grant` that is passed to the issuer. This however implies that maybe I should implement different `Issuer` for both access and refresh grants? This however doesn't make sense either since I need to use different - and probably somehow hardcoded - expiry times for both of those tokens. Or perhaps I don't understand where this `Grant` instance comes from when implementing an `Issuer`.

On thing that confuses me on top of this is how to set different access and refresh token expiry times when using `TokenMap`. It seems to me that they are always set to the same expiry time and it cannot be changed.

Maybe this is also related to #117 and I'd be happy to help out with some examples once I understand how to implement this.

貢獻指南

開啟貢獻指南

研究方向

查看 Issuer trait 和 TokenMap 實作,以了解目前如何從 Grant 設定過期時間。檢查令牌生成和 Generic 端點周圍的程式碼。目標是允許為存取令牌和重新整理令牌設定單獨的過期時間,可能透過修改 Grant 的處理方式或引入單獨的簽發者來實現。查看 issue #117 以獲取相關背景。

由索引模型根據 Issue 內容生成。

評估

領域
authentication, authorization, backend
Issue 類型
功能
難度
4/5
預估耗時
3-5 天
活躍度
停滯
描述清晰度
基本清楚
新手友好度
45/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。