-
CMS plans to use HashiCorp Vault to securely stores long-lifetime credentials. Refresh-tokens from IAM would be stored in the vault. To avoid re-authorization after the refresh-token lifetime expires,…
-
### Feature Description
UNDER GSSOC 24
Feature that add morden-auth solution
### Use Case
The feature of implementing access and refresh tokens addresses the need for a smooth and uninterrup…
-
Currently the tokens expire after ~ 15 minute, and the user needs to logout/login to get access back. It's painful, and avoidable by refreshing the tokens.
Would be a good time to also remove the a…
-
I was surprised to find that [FAPI](https://openid.net/specs/openid-financial-api-part-1-1_0.html) does not mandate refresh tokens. maybe this profile should also relax mandating refresh tokens..
> t…
-
The current auth flow is as follows:
1. DID signs a consent message to unlock a `context` using the private key for the DID (this happens in the Vault).
2. The signed consent message is sent to the s…
-
Hi!
I've been reading through the code and I'm trying to understand if, and how, the `RefreshToken(token)` methods are being called.
My assumption is that calling those methods is something I w…
-
-
We currently are not revoking refresh tokens, which means they can be reused multiple times (until a different token is used).
Recommended settings are to revoke immediately on first use.
**Can we m…
-
-
As per emails to dev-fxa, refresh tokens are now a thing. This issue is slightly exploratory. Do we need to do anything with it? Should we expect to receive a refresh token or an access token?
If we …