server
server copied to clipboard
Longer OAuth refresh token expiry
I'm developing an app an chose to use our existing Nextcloud as OAuth SSO - which is great in general :+1: - but currently requires users to re-authenticate with Nextcloud very frequently, which is quite tedious (see https://github.com/nextcloud/server/issues/17165).
The access token has an expiry of 1 hour, which is rather short, but fine - as long as the refresh token has a long validity, but I don't think this is the case for Nexcloud - the refresh token seems to have the same expiry.
Auto-refreshing the token from my backend for every user every hour seems a bit overkill ...
I would opt for changing this refresh token validity. At least make it configurable. (also the 1h on the access token imho)