You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Sep 18, 2021. It is now read-only.
I am not sure if the following observed behavior is expected or a bug; so please advise as you see fit.
Assuming the Client configuration shown in the log section below where:
AccessTokenLifetime=18000 (5 hours or T5 for simplicity)
AbsoluteRefreshTokenLifetime=28800 (8 hours or T8 for simplicity)
,and the following sequence of events:
The refresh token is created at time T0 with expiration at T8
We use the refresh token at T0 (for simplicity) to get an AccessToken
The AccessToken expiration is set to T5 as expected
At T5 a new AccessToken is requested and since we're still within the AbsoluteRefreshTokenLifetime T8 the client is granted the token request.
The problem is:
The new AccessToken (step 4) has an expiration of T10 which is greater than the AbsoluteRefreshTokenLifetime T8. Which means the Client is authorized to continue its' usual operation past the AbsoluteRefreshTokenLifetime deadline (two hours if you're counting).
Question / Issue
I am not sure if the following observed behavior is expected or a bug; so please advise as you see fit.
Assuming the Client configuration shown in the log section below where:
AccessTokenLifetime=18000 (5 hours or T5 for simplicity)
AbsoluteRefreshTokenLifetime=28800 (8 hours or T8 for simplicity)
,and the following sequence of events:
The problem is:
The new AccessToken (step 4) has an expiration of T10 which is greater than the AbsoluteRefreshTokenLifetime T8. Which means the Client is authorized to continue its' usual operation past the AbsoluteRefreshTokenLifetime deadline (two hours if you're counting).
Relevant parts of the log file
The text was updated successfully, but these errors were encountered: