Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The same expiresIn is returned if the token is requested twice. #134

Open
nebehr opened this issue Feb 3, 2020 · 4 comments
Open

The same expiresIn is returned if the token is requested twice. #134

nebehr opened this issue Feb 3, 2020 · 4 comments

Comments

@nebehr
Copy link

nebehr commented Feb 3, 2020

Since expiresIn is calculated at the moment of AccessToken creation (#107), it remains the same no matter how many times it has been requested. Also, since it is apparently non-negative at the moment of creation, AccessToken#isExpired method will never return true, which renders GrantHandler#shouldRefreshAccessToken and corresponding branch in GrantHandler#issueAccessToken useless.

Wouldn't it be better if expiresIn was recalculated upon each request? Shouldn't the expiration date/time be immutable, not the time until expiration?

@tsuyoshizawa
Copy link
Member

We expect that AccessToken use only one instance for one request coming.

The access token is created when user authorize via OAuth server first.
With the created access token, expiresIn is evaluated when calling the API in a request, so that AccessToken#isExpired can call true.

@nebehr
Copy link
Author

nebehr commented Feb 6, 2020

If AccessToken has to be reissued upon each request, what's the use of methods such as getStoredAccessToken or even the logic to refresh it? Just send a new request and get a new token every time.

My understanding was different. I assumed that created AccessToken remains valid and is returned for all requests until it expires, so there is no need to reissue it until then.

Also, I don't see how expiresIn can evaluate to false. It is eagerly evaluated in AccessToken constructor when createAccessToken is called, and the only way it can be expired at the same moment is if you provide a negative lifeSeconds which is not a valid use case anyway.

@tsuyoshizawa
Copy link
Member

If AccessToken has to be reissued upon each request, what's the use of methods such as getStoredAccessToken or even the logic to refresh it?

We expect that getStoredAccessToken is used for cache on your datastore.

I assumed that created AccessToken remains valid and is returned for all requests until it expires, so there is no need to reissue it until then.

So you can return cached access token from datastore until access token expires by getStoredAccessToken. You just return None on the method if you want to create new access token everytime.

I don't see how expiresIn can evaluate to false. It is eagerly evaluated in AccessToken constructor when createAccessToken is called,

By saving and getting the access token created time in the datastore, you should be able to specify lifeSeconds and take expiresIn to false.

I made a sample code before. I hope it help you. https://github.com/tsuyoshizawa/scala-oauth2-provider-example-skinny-orm/blob/master/app/controllers/OAuthController.scala

@nebehr
Copy link
Author

nebehr commented Feb 6, 2020

you can return cached access token

But when you return this cached access token, it will have expiresIn from the time it was first calculated, i.e. when it was created! That was my point. When I retrieve access token from cache, I expect to see actual time until expiration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants