oauth2-server

oauth2-server copied to clipboard

Make the /verify endpoint accept a token instead of client creds

1

This would mean less evaluations of scrypt and less handling of the credentials themselves.

tvh

A token_refresh grant should issue a new refresh token only when the existing refresh token is due to expire before the new bearer token.

thsutton

It should be possible to control the provision of refresh tokens. Particular policies that would likely be useful: - Include/exclude for particularly non-/sensitive scopes. - Include/exclude for particularly non-/trusty-worthy clients.

thsutton

Hackage release

11

Hi, have you got any plans to release oauth2-server to hackage?

alexbiehl