You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We add the refresh_token parameter to login/register requests to receive a refresh_token(used to request new access tokens) and an access_token in addition to a expires_in_ms interval (to estimate client side when the token expires).
We should handle the cases where refresh_token is empty (server may not support refresh tokens or not have it enabled), expires_in_ms is empty ( the access token does not expire).
There is a /refresh endpoint where the refresh_token can be provided to gain a new access token.
Refresh tokens rotate, each time we call the refresh endpoint we also get a new refresh_token. Therefore we must be careful around the time of each refresh that if we have multiple concurrent requests we don't make multiple refresh requests or mishandle the new refresh_token.
We can preemptively refresh the token shortly before it expires to minimise any disruption to the user(waiting on the refresh request before a user request can be made). On iOS the server timeout we set on sync requests is 30s, so sometime like 60s seems reasonable for preemptive expiry.
Rollout plan:
Distribute an alpha build or maybe add to dev feature flags.
Enable for all beta users and monitor for a period of time.
Ship to prod and monitor.
The text was updated successfully, but these errors were encountered:
Add support for refresh token:
https://github.com/matrix-org/matrix-doc/blob/main/proposals/2918-refreshtokens.md
matrix-org/synapse#11427
Implementation Highlights:
refresh_token
parameter to login/register requests to receive arefresh_token
(used to request new access tokens) and anaccess_token
in addition to aexpires_in_ms
interval (to estimate client side when the token expires).refresh_token
is empty (server may not support refresh tokens or not have it enabled), expires_in_ms is empty ( the access token does not expire)./refresh
endpoint where therefresh_token
can be provided to gain a new access token.refresh
endpoint we also get a newrefresh_token
. Therefore we must be careful around the time of each refresh that if we have multiple concurrent requests we don't make multiple refresh requests or mishandle the newrefresh_token
.sync
requests is 30s, so sometime like 60s seems reasonable for preemptive expiry.Rollout plan:
The text was updated successfully, but these errors were encountered: