Open mdouchement opened 3 years ago
Currently JWT tokens with revoke strategy is used but there is no refresh of this token. We should move to a Session mechanism:
access_token
Authorization
refresh_token
Currently JWT tokens with revoke strategy is used but there is no refresh of this token. We should move to a Session mechanism:
access_token
that expires after 30 days (must be configurable)Authorization
header in PASETO formatrefresh_token
that expires after 1 year (must be configurable)