core/appview/oauth/ at 4da761448baa393897ce13e515d652eb1736387a · alice.pds.demo.boltless.dev/core · Tangled

alice.pds.demo.boltless.dev / core

0

This repository has no description

0

core / appview / oauth

4 files

at 4da761448baa393897ce13e515d652eb1736387a

oppiliappan appview/oauth: use ResumeSession when fetching currently logged in user 9mo ago

appview/oauth: use ResumeSession when fetching currently logged in user the final addition to my collection of oauth fixes: the session cookie is not a sufficient indication of a logged-in-ness of a user, we additionally validate this cookie against the session on redis using ResumeSession and kick users out if their session is invalid. previously, a user may have appeared to be logged in (via the profile picture on the top right), but creating an auth'd request would have login-prompted them. Signed-off-by: oppiliappan <me@oppi.li>

9 months ago

appview/oauth: add client name and uri to metadata responses Signed-off-by: oppiliappan <me@oppi.li>

9 months ago

appview/oauth: use ResumeSession when fetching currently logged in user the final addition to my collection of oauth fixes: the session cookie is not a sufficient indication of a logged-in-ness of a user, we additionally validate this cookie against the session on redis using ResumeSession and kick users out if their session is invalid. previously, a user may have appeared to be logged in (via the profile picture on the top right), but creating an auth'd request would have login-prompted them. Signed-off-by: oppiliappan <me@oppi.li>

9 months ago

appview/oauth: invalidate sessions if inactive for too long if sessions are inactive for too long, tokens will not be refreshed, and calling authorized xrpc methods will error out with invalid_grant. this changeset does two things: - tracks the last time a session was active using a new redis pair: `oauth:session_meta:<did>:<session>`, this is updated every time `SaveSession` is called - checks for session inactivity every time `GetSession` is called, and deletes the session if so this way, `GetSession` will never return a session with expired tokens. Signed-off-by: oppiliappan <me@oppi.li>

9 months ago