Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update jwt.helper.js to increase Github JWT Token duration #712

Merged
merged 2 commits into from
Aug 4, 2023

Conversation

HugoReeves
Copy link
Collaborator

Summary:
Currently Github users are logged out after 5 minutes. This makes it impossible to save changes without refreshing and losing all unsaved changes. As far as I can tell, refresh tokens have not been implemented currently. Increasing the JWT token duration to 1 day should make it more practical to edit Github models. A longer term solution is to finish implementation of refresh tokens.

Description for the changelog:
Update access token and refresh token duration.
Access token updated to 1 day from 5 minutes.
Refresh token updated to 7 days from 24 hours.

Other info:
None

Update access token and refresh token duration.
Access token updated to 1 day from 5 minutes.
Refresh token updated to 7 days from 24 hours.
Copy link
Collaborator

@jgadsden jgadsden left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @HugoReeves , these changes make good sense and I agree with the values for now; 1 day timeout is reasonable if there is no refresh token mechanism. We can probably trim this back to something like 15 minutes when refresh is in place

I had not come across it earlier because I tend to use local login for testing
did you want to raise an issue for the refresh token?

@jgadsden
Copy link
Collaborator

jgadsden commented Aug 4, 2023

there is a failing unit test because it is searching for '5m', did you want to fix that up? otherwise I can modify this

I will delay the 2.0.4 release so that we can get this change in

@jgadsden jgadsden added bug Something isn't working version-2.1 labels Aug 4, 2023
@HugoReeves
Copy link
Collaborator Author

@jgadsden The unit test should be updated now.

@jgadsden
Copy link
Collaborator

jgadsden commented Aug 4, 2023

do not worry about the failing 'CI pipeline / Build docker image' test, that is a permissions issue
I have offered you 'Maintain' rights if you want to accept, you should then be able to merge the changes in

@HugoReeves HugoReeves merged commit 5508341 into OWASP:main Aug 4, 2023
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working version-2.1
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants