search

wagnerdelima / drf-social-oauth2

drf-social-oauth2 makes it easy to integrate Django social authentication with major OAuth2 providers, i.e., Facebook, Twitter, Google, etc.
https://drf-social-oauth2.readthedocs.io/en/latest/
MIT License
270 stars 34 forks source link

Refresh token expire time #110

Closed pear9 closed 2 years ago

pear9 commented 2 years ago

Is there some minimum time that refresh token should have cause when I tested it for 12 seconds oauth2_settings.DEFAULTS['REFRESH_TOKEN_EXPIRE_SECONDS'] = 12 it doesnot expire or it doesnot exist

wagnerdelima commented 2 years ago

mm, the documentation does not say anything about a minimum value. What are you trying to do exactly? And why did you set 12 seconds?

Ref: https://django-oauth-toolkit.readthedocs.io/en/latest/settings.html?highlight=REFRESH_TOKEN_EXPIRE_SECONDS#refresh-token-expire-seconds

pear9 commented 2 years ago

12 secs was just for testing purpose

In documentation it is mentioned that: NOTE: This value is completely ignored when validating refresh tokens. If you don’t change the validator code and don’t run cleartokens all refresh tokens will last until revoked or the end of time. You should change this.

So I think Management command cleartokens should be run be regular interval if the expire time of Refresh token is less than 1day. But still confusing.

wagnerdelima commented 2 years ago

Yes it's a little confusing indeed. But in this case, your tokens are the access tokens. By the docs it has nothing to do with the refresh tokens themselved.

Update My bad, you mentioned refresh tokens.