Make expiry of auth requests configurable#1372
Conversation
3c1e667 to
468c74d
Compare
srenatus
left a comment
There was a problem hiding this comment.
This is a fine band aid 😃 Thank you for contributing. One nitpick, but this looks good. 👍
| expiry: | ||
| signingKeys: "6h" | ||
| idTokens: "24h" | ||
| authRequests: "24h" |
There was a problem hiding this comment.
Could we attempt to test something that's not the default here? I know it shouldn't matter for the code path, but it's just to be on the safe side. Let's do 25hrs or something 😉 (And if you care to, changing signingKeys and idTokens would be cool, too.
There was a problem hiding this comment.
Pushed a second commit.
|
@mxey Out of curiosity, what's a setting you'd propose to use in practice? (Just gathering opinions 😄 ) |
I am going to set it to 5 minutes, because I don't expect our (internal) users to leave open the login dialog and come back an hour later. |
💭 Or a day. Thanks again! |
…expiry Make expiry of auth requests configurable This is a band-aid against dexidp#1292 I did not change the default from 24h, but I think it should be much lower for safety.
This is a band-aid against #1292
I did not change the default from 24h, but I think it should be much lower for safety.