Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement refresh tokens #4943

Closed
langleyd opened this issue Jan 13, 2022 · 0 comments
Closed

Implement refresh tokens #4943

langleyd opened this issue Jan 13, 2022 · 0 comments
Assignees
Labels
T-Enhancement New features, changes in functionality, performance boosts, user-facing improvements

Comments

@langleyd
Copy link
Member

langleyd commented Jan 13, 2022

Add support for refresh token:
https://github.com/matrix-org/matrix-doc/blob/main/proposals/2918-refreshtokens.md
matrix-org/synapse#11427

Implementation Highlights:

  • We add the refresh_token parameter to login/register requests to receive a refresh_token(used to request new access tokens) and an access_token in addition to a expires_in_ms interval (to estimate client side when the token expires).
  • We should handle the cases where refresh_token is empty (server may not support refresh tokens or not have it enabled), expires_in_ms is empty ( the access token does not expire).
  • There is a /refresh endpoint where the refresh_token can be provided to gain a new access token.
  • Refresh tokens rotate, each time we call the refresh endpoint we also get a new refresh_token. Therefore we must be careful around the time of each refresh that if we have multiple concurrent requests we don't make multiple refresh requests or mishandle the new refresh_token.
  • We can preemptively refresh the token shortly before it expires to minimise any disruption to the user(waiting on the refresh request before a user request can be made). On iOS the server timeout we set on sync requests is 30s, so sometime like 60s seems reasonable for preemptive expiry.

Rollout plan:

  1. Distribute an alpha build or maybe add to dev feature flags.
  2. Enable for all beta users and monitor for a period of time.
  3. Ship to prod and monitor.
@langleyd langleyd self-assigned this Jan 13, 2022
@langleyd langleyd added the T-Enhancement New features, changes in functionality, performance boosts, user-facing improvements label Jan 13, 2022
@langleyd langleyd mentioned this issue Jan 21, 2022
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
T-Enhancement New features, changes in functionality, performance boosts, user-facing improvements
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant