Skip to content
This repository was archived by the owner on Jan 24, 2019. It is now read-only.

Conversation

jehiah
Copy link
Member

@jehiah jehiah commented Jun 23, 2015

Currently the Google provider uses an online token which expires in 60 minutes. This means that the token is not valid when passed to upstreams for some duration of time, and that it's not possible to refresh the cookie for a new duration (because the token expires and can't be revalidated).

The good news, refreshing a token does ensure that the token is valid. The bad news, with the google provider sessions fail when a refresh is attempted >1hr after cookie set.

@jehiah
Copy link
Member Author

jehiah commented Jun 23, 2015

@mbland
Copy link
Contributor

mbland commented Jun 23, 2015

Did that change recently? Coulda swore when I first started using the google_auth_proxy that the Google auth page said the app wanted offline access. The API docs don't seem to describe a way to set the expiration manually, but according to this, it seems like it should take six months, not one hour:

https://developers.google.com/identity/protocols/OAuth2#expiration

Still, I think customizing the Google provider shouldn't take too much effort. From the point of view of OauthProxy.ServeHTTP(), the contents of the access_token are opaque; we could encode/decode a refresh_token to/from the same value within the Google provider without rippling changes through most of the rest of the code. We'd have to override GetLoginURL(), and probably add a RefreshToken() method (or update the interface to ValidateToken() to return the validated token string). Only catch is that clients using --pass-access-token will need to know about the concatenated format. Happy to take a stab at it, unless you get to it first.

@jehiah jehiah force-pushed the google_refresh_token_116 branch from 1d85117 to 46c0d80 Compare June 23, 2015 17:53
@jehiah jehiah force-pushed the google_refresh_token_116 branch from 46c0d80 to 8d50b37 Compare June 23, 2015 17:56
jehiah added a commit that referenced this pull request Jun 23, 2015
@jehiah jehiah merged commit b9ae5dc into bitly:master Jun 23, 2015
@jehiah jehiah deleted the google_refresh_token_116 branch September 23, 2015 13:57
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Development

Successfully merging this pull request may close these issues.

2 participants