search

thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.49k stars 1.12k forks source link

Allow refresh token to never expire #1361

Closed AurelienPillevesse closed 11 months ago

AurelienPillevesse commented 11 months ago

After some reading about oAuth2 topic : https://www.oauth.com/oauth2-servers/access-tokens/access-token-lifetime/

  • Short-lived access tokens and long-lived refresh tokens Typically services using this method will issue access tokens that last anywhere from several hours to a couple weeks. When the service issues the access token, it also generates a refresh token that never expires and returns that in the response as well. (Note that refresh tokens can’t be issued using the Implicit grant.)

This part is interesting because as I can see in this repository, currently it's not possible to generate a refresh token that never expires.

https://github.com/thephpleague/oauth2-server/blob/eb91b4190e7f6169053ebf8ffa352d47e756b2ce/src/Grant/AbstractGrant.php#L152

What do you think about it ?