Skip to content

Unusable OAuth refresh token #33223

Open
Open
@tennox

Description

@tennox

I'm developing an app an chose to use our existing Nextcloud as OAuth SSO - which is great in general 👍 - but currently requires users to re-authenticate with Nextcloud very frequently, which is quite tedious (see #17165).

The access token has an expiry of 1 hour, which is rather short, but fine - as long as the refresh token has a long validity, but I don't think this is the case for Nexcloud - the refresh token seems to have the same expiry.

Auto-refreshing the token from my backend for every user every hour seems a bit overkill ... I switched to client-side OAuth, so that's not a possibility either

I would opt for changing this refresh token validity. At least make it configurable. (also the 1h on the access token imho)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions