[7.2] Add non-persistent AT docs#6099
Merged
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughThis PR updates the token persistence documentation to add guidance on recovery flows for token constraint violations and introduces comprehensive documentation for a new JWT access token persistence optimization feature, including configuration, behavior, and cleanup procedures. ChangesToken Persistence Documentation & Recovery
Suggested labels
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 60 minutes.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
en/identity-server/7.2.0/docs/deploy/token-persistence.md (1)
49-60:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUse one canonical constraint name in this recovery section.
This section references
CON_APP_KEY, while earlier parts of the same document useCONN_APP_KEY. Please standardize to the exact constraint name used by the product to avoid troubleshooting confusion.As per coding guidelines, use one term per concept and do not switch terminology mid-document.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@en/identity-server/7.2.0/docs/deploy/token-persistence.md` around lines 49 - 60, The recovery section uses a different constraint name (CON_APP_KEY) than earlier in the document (CONN_APP_KEY); standardize by replacing the incorrect occurrences in the recovery flow with the canonical product constraint name CONN_APP_KEY so the whole document consistently uses CONN_APP_KEY (search for "CON_APP_KEY" in the token-persistence.md recovery paragraphs and update those references to "CONN_APP_KEY").
🧹 Nitpick comments (1)
en/identity-server/7.2.0/docs/deploy/token-persistence.md (1)
180-187: ⚡ Quick winAdd defaults and valid values for
oauth.token_persistenceproperties.This example is helpful, but it should also state each property’s default and allowed values (
true/false) so users can apply the change safely.As per coding guidelines, “When documenting configuration, describe what the setting controls, state the default value, state constraints (type, valid range, allowed values), provide a minimal example, and explain when the user should change it.”
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@en/identity-server/7.2.0/docs/deploy/token-persistence.md` around lines 180 - 187, The example configuration for oauth.token_persistence lacks default values, allowed values and short descriptions for each property; update the token-persistence.md section to document each property (persist_access_token, retain_revoked_token, persist_refresh_token) by stating what it controls, its default (true/false), its type/constraints (boolean; allowed values: true/false), and when to change it, then keep the minimal toml example shown; ensure the property names and their defaults are clearly called out next to the example so readers can apply the change safely.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@en/identity-server/7.2.0/docs/deploy/token-persistence.md`:
- Line 88: Fix the spacing in the unsupported-features list item: update the
sentence containing "**Token binding**, **Retrieving authorized apps for
user**,**Rich Authorization Details**, and **OIDC Request Object**" so there is
a space after the comma between "**Retrieving authorized apps for user**,**Rich
Authorization Details**" (i.e., change to "**Retrieving authorized apps for
user**, **Rich Authorization Details**") and ensure consistent single spaces
after all commas in that list.
---
Outside diff comments:
In `@en/identity-server/7.2.0/docs/deploy/token-persistence.md`:
- Around line 49-60: The recovery section uses a different constraint name
(CON_APP_KEY) than earlier in the document (CONN_APP_KEY); standardize by
replacing the incorrect occurrences in the recovery flow with the canonical
product constraint name CONN_APP_KEY so the whole document consistently uses
CONN_APP_KEY (search for "CON_APP_KEY" in the token-persistence.md recovery
paragraphs and update those references to "CONN_APP_KEY").
---
Nitpick comments:
In `@en/identity-server/7.2.0/docs/deploy/token-persistence.md`:
- Around line 180-187: The example configuration for oauth.token_persistence
lacks default values, allowed values and short descriptions for each property;
update the token-persistence.md section to document each property
(persist_access_token, retain_revoked_token, persist_refresh_token) by stating
what it controls, its default (true/false), its type/constraints (boolean;
allowed values: true/false), and when to change it, then keep the minimal toml
example shown; ensure the property names and their defaults are clearly called
out next to the example so readers can apply the change safely.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 420e3b22-5340-41fa-8ab2-aa73708d6320
📒 Files selected for processing (1)
en/identity-server/7.2.0/docs/deploy/token-persistence.md
| - **Opaque token generation** will continue to work as expected for applications configured to use opaque tokens. | ||
| - Applications configured for **JWT access token type** will be switched to **non-persistent access token mode**, meaning JWT access tokens will no longer be stored in the database. | ||
| - In the case of persistent token storage, if an active access token already exists during the token generation flow, the existing token will be marked as inactive. However, in the non-persistent mode, multiple active tokens can exist, as the authorization server does not store the access tokens. | ||
| - **Token binding**, **Retrieving authorized apps for user**,**Rich Authorization Details**, and **OIDC Request Object** features are currently not supported in **non-persistent access token mode**. |
Contributor
There was a problem hiding this comment.
Fix spacing in the unsupported-features list item.
There is a missing space after the comma in **,**Rich Authorization Details**, which hurts readability.
As per coding guidelines, use plain language and keep list content clear and easy to scan.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@en/identity-server/7.2.0/docs/deploy/token-persistence.md` at line 88, Fix
the spacing in the unsupported-features list item: update the sentence
containing "**Token binding**, **Retrieving authorized apps for user**,**Rich
Authorization Details**, and **OIDC Request Object**" so there is a space after
the comma between "**Retrieving authorized apps for user**,**Rich Authorization
Details**" (i.e., change to "**Retrieving authorized apps for user**, **Rich
Authorization Details**") and ensure consistent single spaces after all commas
in that list.
Thumimku
approved these changes
May 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
$subject
Issue: wso2/product-is#24066
Related PRs
Test environment
Security checks