zalando-stups / planb-provider

Plan B OpenID Connect Provider issuing JWT tokens
http://planb.readthedocs.org/
Other
16 stars 11 forks source link

Refresh token support #120

Open hafizh opened 8 years ago

hafizh commented 8 years ago

In Fashion store apps we have a requirement to keep the user logged in almost all the time (except checkout). So, once a guest user has logged in, we should almost never ask them to login again. I think we can achieve this with a refresh token. The refresh token would then have a wide scope for the whole app functionality, except checkout. Checkout would have a separate scope, and no refresh token. For the case where user logs out, we would then need to revoke the refresh token.

For this use case we would need to have the refresh token support as stated in the spec.