Software / code / prosody
Changeset
13073:9e5802b45b9e
mod_tokenauth: Only check if expiry of expiring tokens
Some tokens, e.g. OAuth2 refresh tokens, might not have their lifetime
explicitly bounded here, but rather be bounded by the lifetime of
something else, like the OAuth2 client.
Open question: Would it be better to enforce a lifetime on all tokens?
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Wed, 12 Apr 2023 10:21:32 +0200 |
| parents | 13072:7fcf41b541e0 |
| children | 13074:794a5ad5495e |
| files | plugins/mod_tokenauth.lua |
| diffstat | 1 files changed, 1 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/plugins/mod_tokenauth.lua Mon Apr 10 14:24:39 2023 +0200 +++ b/plugins/mod_tokenauth.lua Wed Apr 12 10:21:32 2023 +0200 @@ -186,7 +186,7 @@ -- Check expiry local now = os.time(); - if token_info.expires < now then + if token_info.expires and token_info.expires < now then module:log("debug", "Token has expired, cleaning it up"); grant.tokens[secret_hash] = nil; token_store:set_key(token_user, token_id, grant);
