search

heroku / roadmap

This is the public roadmap for Salesforce Heroku services.
13 stars 0 forks source link

Refresh Token does not expires. #282

Open aghatt opened 7 months ago

aghatt commented 7 months ago

Required Terms

What service(s) is this request for?

All services using Oauth

Tell us about what you're trying to solve. What challenges are you facing?

For Add-on to communicate its clients they need an Oauth token which expires in 8 hrs. In order to renew the token a refresher token is required to be submitted to get the oauth token. This refresher token never expires. Both the tokens should have a expiry in order to improve the security posture of this Oauth based authorization.

friism commented 6 months ago

Thanks for opening this - this is something we were already looking at improving. We may end up adopting some of the measures that Salesforce has: https://help.salesforce.com/s/articleView?id=sf.connected_app_manage_oauth.htm&type=5