Incorrect expiry time in RefreshToken in OIDC?

[zetaab]

Description:

My current setup is that token lifetime is 60 minutes and refresh token lifetime is 2 days (configured in identity provider). However, with the current expiry times envoy cookie model cannot just work. Lets say that I got new tokens 10:41:13Z, everything is stored to cookies. Normal token will expiry 11:41:13Z and after that it is supposed to use refresh token to fetch new normal token. However, that is impossible because refresh token cookie was expired 11:41:13Z as well and there are no cookie anymore. RefreshToken lifetime should be longer than normal tokens. Should it be configurable?

Repro steps:

Include sample requests, environment, etc. All data and inputs required to reproduce the bug.

Note: If there are privacy concerns, sanitize the data prior to sharing.

Environment:

Include the environment like gateway version, envoy version and so on.

Logs:

Include the access logs and the Envoy logs.

[arkodg]

cc @zhaohuabing

[zhaohuabing]

@zetaab I believe this is because the useRefreshToken option is not turned on. There is an ongoing work to address this on #3423 .