fix: set etcd user_session ttl to refresh token expiry time #5122
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
otherwise the session will be deleted when you refresh your token, and the token refresh will fail Signed-off-by: Kristian Grønås <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Otherwise the session will already be deleted when you refresh your token, and the token refresh will fail
What is this change?
This makes the user_session etcd lease last as long as the refresh token
Why is this change necessary?
Without it we were seeing errors like this:
{"error":"key /sensu.io/user_sessions/admin/<id> not found", "level":"info", "msg":"unexpected error while authorizing refresh token", "time":"2025-08-18T10:47:20+02:00"}We also had trouble refreshing the token in the web ui, as a stopgap we increased the access token expiry
Does your change need a Changelog entry?
Yes
Do you need clarification on anything?
Were there any complications while making this change?
Have you reviewed and updated the documentation for this change? Is new documentation required?
No
How did you verify this change?
check the expiry with
etcdctl --endpoints localhost:2379 lease timetolive <lease-id> --keysset a low access token expiry, and wait 6 minutes and try to run a sensuctl command, and see that the token refresh now succeeds
Is this change a patch?
Yes