JanssenProject / JanssenProject/jans

doc(jans-auth-server): show asynchronous calls to third-party in custom scripts

Open
#10,942 0 comments 0 reactions 1 assignee Claimed by @yuriyz View on GitHub
comp-jans-auth-server
Dominant language
Java
Stars
648
Forks
174
Avg merge
1d 18h
Merged PRs (30d)
110

Description

### Description

Custom scripts allow to inject code directly into AS execution. It gives a lot of flexibility but also responsibility.
Recently there were incident when UpdateToken script tried synchronously call third-party to check balane. This check balance call holded execution for 60seconds. It ruins AS perfomance.

If there are calls to third-party it is better to use asynchronous approach instead of synchronous.
1. let access_token to be returned but schedule asynchronous check. If check is OK -> do nothing. If failed -> revoke token.
2. it is bad practice to call third-party for each call. Results must be cashed when possible.

We need documentation and sample script that shows how asynchronous approach works.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.