search

nokia / kong-oidc

OIDC plugin for Kong
Apache License 2.0
461 stars 330 forks source link

Refreshing access token doesn't work as expected #33

Closed nbkntu closed 6 years ago

nbkntu commented 6 years ago

I have a problem with refreshing access token. My access token has expiration time of 1 hour. It seems that the session cookie (supported by lua-resty-session library) also has the same expiration time.

When a request comes in slightly after 1 hour, it should trigger refreshing the access token which has just expired. However since the session has also expired, a redirect to SSO login would happen to ask the user to re-login instead.

How would I resolve this issue?

My current workaround is to set access_token_expires_leeway to say 10 minutes in the config so refreshing the token can happen before the session expires. [https://github.com/nokia/kong-oidc/blob/master/kong/plugins/oidc/utils.lua#L52] However this requires making the field available in the plugin parameter list.

Thanks!

Trojan295 commented 6 years ago

lua-resty-session uses ngx.var.session_cookie_lifetime to calculate the expiration date. You could try to set this variable in your nginx-kong configuration (https://github.com/openresty/lua-nginx-module#ngxvarvariable).

nbkntu commented 6 years ago

Yay, setting session_cookie_lifetime in the config works! Thanks!

a-maggioni commented 1 year ago

Yay, setting session_cookie_lifetime in the config works! Thanks!

How did you set "session_cookie_lifetime" in your kong configuration?