-
Notifications
You must be signed in to change notification settings - Fork 3.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add ability for inference backend to revoke auth refresh tokens #2175
Add ability for inference backend to revoke auth refresh tokens #2175
Conversation
quick question, where would would we need this functionality? for malicious actors? when the user logs out? |
I don't know if we strictly need it, but it's a common practice. As refresh tokens are much longer-lived compared to access tokens, if one were compromised it potentially gives the attacker a long window, so it might be useful to have this ability in place in case it's ever required for that use case |
I think this is ready to merge now - tested locally with text client - but will wait for @yk review |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thank you
An admin endpoint is provided to revoke all refresh tokens for a given user ID. This is achieved by storing hashed refresh tokens in a backend DB table.