dotnet / dotnet/aspnetcore

Refreshing auth tokens for SignalR

Open
#5,297 88 comments 45 reactions 1 assignee Assigned to @BrennanConroy View on GitHub
affected-medium area-signalr Blazor ♥ SignalR enhancement Needs: Design on-roadmap severity-major
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

Below is one option we've considered, but I'm re-framing this issue to build *some* story for refreshing auth tokens.

To improve the ability to "refresh" expired tokens, we should consider caching the access token provided by the factory. Then, when an HTTP request gets a `401`, we call the factory again before re-issuing the request. That way the user can configure a process to "refresh" the token without forcing the connection to be reestablished

* For the WebSockets transport, this has no effect. There is only ever a single request. This logic would **not** cover reconnecting in the event of something like #1159 (where the WebSocket is terminated when the token expires)
* For the SSE transport, this only affects `POST` (send) requests. We would call the token factory again and re-issue the send. The unsent data would stay buffered in the pipe
* For Long Polling, this affects `POST` requests like SSE, and the `GET` (poll) requests. The client would assume that a `401` error indicates that the data is **still in the pipe** for them to read. The server would be expected to keep data in the pipe in the case of a `401`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.