Unusable OAuth refresh token
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
I'm developing an app an chose to use our existing Nextcloud as OAuth SSO - which is great in general 👍 - but currently requires users to re-authenticate with Nextcloud very frequently, which is quite tedious (see https://github.com/nextcloud/server/issues/17165).
The access token has an expiry of 1 hour, which is rather short, but fine - as long as the refresh token has a long validity, but I don't think this is the case for Nexcloud - the refresh token seems to have the same expiry.
Auto-refreshing the token from my backend for every user every hour seems a bit overkill ... I switched to client-side OAuth, so that's not a possibility either
I would opt for changing this refresh token validity. At least make it configurable. (also the 1h on the access token imho)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in apps/oauth2/lib/Controller/OauthApiController.php at the referenced lines 159 and 174, and trace how the refresh-token and access-token expiries are set. Confirm whether their lifetimes can be configured independently, then define the relevant configuration and verify that OAuth clients receive the intended expiries.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100