server icon indicating copy to clipboard operation
server copied to clipboard

Longer OAuth refresh token expiry

Open tennox opened this issue 3 years ago • 0 comments

I'm developing an app an chose to use our existing Nextcloud as OAuth SSO - which is great in general :+1: - but currently requires users to re-authenticate with Nextcloud very frequently, which is quite tedious (see https://github.com/nextcloud/server/issues/17165).

The access token has an expiry of 1 hour, which is rather short, but fine - as long as the refresh token has a long validity, but I don't think this is the case for Nexcloud - the refresh token seems to have the same expiry.

Auto-refreshing the token from my backend for every user every hour seems a bit overkill ...

I would opt for changing this refresh token validity. At least make it configurable. (also the 1h on the access token imho)

tennox avatar Jul 13 '22 12:07 tennox