search

mozilla / mozilla-django-oidc

A django OpenID Connect library
https://mozilla-django-oidc.readthedocs.io
Mozilla Public License 2.0
449 stars 168 forks source link

Added on-demand session token refresh #499

Open drwonky opened 1 year ago

drwonky commented 1 year ago

Added a special case that allows AJAX queries to refresh the session on demand. AJAX queries simply need to add the header 'X-Refresh-OIDC-Token' to the request and it will reset the session expiration so it generates a reauth redirect. This allows SPAs and other Javascript driven applications to proactively control session refresh.

drwonky commented 1 year ago

See PR #364 for additional context. This is me cleaning up that PR, even if it's 3 years later :wink:

This feature is sorely needed to allow an application to control re-authentication. Say you login to a web app and it tracks how long your session has been open for. It then pops up a warning when you have 30 minutes remaining in your session, then 10 minutes remaining. The popup has a button that would allow the user to re-authenticate directly so they don't have to be rudely interrupted in the middle of their work.

We had this feature in our internal support portal at Oracle so engineers would be prompted to save whatever text they had been writing in a ticket, before their session timed out.