Make OAuth2 refresh tokens valid for longer than access tokens
Closed, ResolvedPublicBUG REPORT
Actions

Assigned To

Authored By

	MarkusRost
	Jul 2 2023, 8:12 AM

Description

Currently $wgOAuth2GrantExpirationInterval has a default value of "PT1H" (one hour) and $wgOAuth2RefreshTokenTTL has a default value of "PT1M" (one minute).

Having refresh tokens expire so much faster than access tokens makes them almost completely useless. Therefore I would like to suggest changing the default value of $wgOAuth2RefreshTokenTTL to something longer like for example "P1M" (one month).

Details

	Subject	Repo	Branch	Lines +/-
	Fix default refresh token expiry	mediawiki/extensions/OAuth	master	+5 -12

Customize query in gerrit

Event Timeline

MarkusRost created this task.Jul 2 2023, 8:12 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 2 2023, 8:12 AM

FWIW on Wikimedia it's set to P365D.

Change 934713 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OAuth@master] Fix default refresh token expiry

https://gerrit.wikimedia.org/r/934713

gerritbot added a project: Patch-For-Review.Jul 2 2023, 9:12 PM

In T340921#8984284, @gerritbot wrote:

Change 934713 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OAuth@master] Fix default refresh token expiry

https://gerrit.wikimedia.org/r/934713

@Tgr typo in extension.json "T1M" -> "P1M"