Refreshing auth tokens for SignalR
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
Below is one option we've considered, but I'm re-framing this issue to build *some* story for refreshing auth tokens.
To improve the ability to "refresh" expired tokens, we should consider caching the access token provided by the factory. Then, when an HTTP request gets a `401`, we call the factory again before re-issuing the request. That way the user can configure a process to "refresh" the token without forcing the connection to be reestablished
* For the WebSockets transport, this has no effect. There is only ever a single request. This logic would **not** cover reconnecting in the event of something like #1159 (where the WebSocket is terminated when the token expires)
* For the SSE transport, this only affects `POST` (send) requests. We would call the token factory again and re-issue the send. The unsent data would stay buffered in the pipe
* For Long Polling, this affects `POST` requests like SSE, and the `GET` (poll) requests. The client would assume that a `401` error indicates that the data is **still in the pipe** for them to read. The server would be expected to keep data in the pipe in the case of a `401`
Contributor guide
Assessment
This issue has not been assessed yet.