Currently we set expiry for new JWT tokens with an expiry field of 1000 years from date of creation. We should probably have a conversation about having this as something lower and setting this as a configuration option. This came up in T244423 around questions of validity of tokens themselves - this is no longer a concern as we set a valid expiry, but it is still a somewhat unreasonable and potentially dangerous value.
Description
Description
Related Objects
Related Objects
Event Timeline
Comment Actions
This is about owner-only tokens, right? (And about access tokens?) Non-owner-only access tokens expire after $wgOAuth2GrantExpirationInterval which is 1 hour by default and 4 hours on Wikimedia servers.
Comment Actions
(Right, when i dug into my test token generated at Special:OAuthConsumerRegistration/propose/oauth2, I was surprised it contains an exp value corresponding to today's date in year 3024, instead of value nearer to claimed 30 days from now. It would be good if the value was meaningful.)
Comment Actions
I'll close this in favor of T412214: Ensure a good experience for apps which want to use OAuth credentials for a long time (refresh token grace period) as we don't want to break the use case of running an app for a very long time without requiring the user going through the authorization dialog, and ATM we don't really have a mechanism for that other than forever-valid access tokens.