Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign updo omit exp if ExpiresAt is zero value #334
Conversation
Signed-off-by: nerocrux <nerocrux@gmail.com>
Due to community feedback, I think it would make sense to have refresh tokens expire optionally. Basically you would be able to set a lifespan, but if none is set the refresh token expires after that time. I think the endpoint should still be able to omit the expiry if it's not set! |
| @@ -202,6 +202,11 @@ func (f *Fosite) WriteIntrospectionResponse(rw http.ResponseWriter, r Introspect | |||
| return | |||
| } | |||
|
|
|||
| expiresAt := int64(0) | |||
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
nerocrux
force-pushed the
nerocrux:nerocrux/fix_introspect_response_exp
branch
from
9a7fc1d
to
16d6d54
|
@aeneasr I have added some tests for this PR. Please take a look at it if you have time.
Got it. Have a nice weekend! |
nerocrux
force-pushed the
nerocrux:nerocrux/fix_introspect_response_exp
branch
2 times, most recently
from
fed290b
to
0b92ccb
Signed-off-by: nerocrux <nerocrux@gmail.com>
nerocrux
force-pushed the
nerocrux:nerocrux/fix_introspect_response_exp
branch
from
0b92ccb
to
10f2864
|
Agreed, thank you for the changes! |
Signed-off-by: nerocrux <nerocrux@gmail.com>
nerocrux commentedNov 9, 2018
•
edited
Related issue
Proposed changes
expwill be omitted ifGetExpiresAt(AccessToken)is nil or zero value (no expiration)GetExpiresAt(AccessToken)is zero value, Unix() will be called, andExpiresAtwill be set to-62135596800because golang's zero time is0001-01-01T00:00:00Zbut not1970-01-01T00:00:00ZChecklist
vulnerability, I confirm that I got green light (please contact hi@ory.sh) from the maintainers to push the changes.
by signing my commit(s). You can amend your signature to the most recent commit by using
git commit --amend -s. If youamend the commit, you might need to force push using
git push --force HEAD:<branch>. Please be very careful when usingforce push.
Further comments
exp. Not sure if this is corrent. Maybe it's better to always omit exp field if we introspect RefreshToken, because there is no expiration time for RefreshToken.expfor introspect RefreshToken is good, I will fire another PR.Thank you!