feat: have OAuth2 Proxy refresh the access token before it expires #173
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
steveherrin
force-pushed
the
sherrin/refresh-tokens
branch
from
6528a8e
to
91de282
Compare
steveherrin
changed the title
steveherrin
force-pushed
the
sherrin/refresh-tokens
branch
from
8529fde
to
7372a23
Compare
I'm basing the default on our existing Cognito pools and clients. This won't work if we need more control: - access tokens expire after 60 minutes, so renew at 59 - refresh tokens expire after 30 days, so the default of 7 days is fine and I haven't made this configurable
steveherrin
force-pushed
the
sherrin/refresh-tokens
branch
from
693c5b1
to
816c04f
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I'm basing the settings on our existing Cognito pools and clients. This won't work if we need more control:
There are others ways to do this. Every stack using the proxy could supply this via extraArgs, but that is leaving a trap for services to forget. There might be some way to keep this in sync with whatever we have set for Cognito, but that's beyond what I know how to do with my current knowledge of our infrastructure.