JanssenProject / JanssenProject/jans
doc(jans-auth-server): show asynchronous calls to third-party in custom scripts
- Dominant language
- Java
- Stars
- 648
- Forks
- 174
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 110
Description
### Description
Custom scripts allow to inject code directly into AS execution. It gives a lot of flexibility but also responsibility.
Recently there were incident when UpdateToken script tried synchronously call third-party to check balane. This check balance call holded execution for 60seconds. It ruins AS perfomance.
If there are calls to third-party it is better to use asynchronous approach instead of synchronous.
1. let access_token to be returned but schedule asynchronous check. If check is OK -> do nothing. If failed -> revoke token.
2. it is bad practice to call third-party for each call. Results must be cashed when possible.
We need documentation and sample script that shows how asynchronous approach works.
Contributor guide
Assessment
This issue has not been assessed yet.