Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Implement refresh tokens #4943

Closed
langleyd opened this issue Jan 13, 2022 · 0 comments
Closed

Implement refresh tokens #4943

langleyd opened this issue Jan 13, 2022 · 0 comments
Assignees
Labels
T-Enhancement New features, changes in functionality, performance boosts, user-facing improvements

Comments

@langleyd
Copy link
Member

langleyd commented Jan 13, 2022

Add support for refresh token:
https://github.com/matrix-org/matrix-doc/blob/main/proposals/2918-refreshtokens.md
matrix-org/synapse#11427

Implementation Highlights:

  • We add the refresh_token parameter to login/register requests to receive a refresh_token(used to request new access tokens) and an access_token in addition to a expires_in_ms interval (to estimate client side when the token expires).
  • We should handle the cases where refresh_token is empty (server may not support refresh tokens or not have it enabled), expires_in_ms is empty ( the access token does not expire).
  • There is a /refresh endpoint where the refresh_token can be provided to gain a new access token.
  • Refresh tokens rotate, each time we call the refresh endpoint we also get a new refresh_token. Therefore we must be careful around the time of each refresh that if we have multiple concurrent requests we don't make multiple refresh requests or mishandle the new refresh_token.
  • We can preemptively refresh the token shortly before it expires to minimise any disruption to the user(waiting on the refresh request before a user request can be made). On iOS the server timeout we set on sync requests is 30s, so sometime like 60s seems reasonable for preemptive expiry.

Rollout plan:

  1. Distribute an alpha build or maybe add to dev feature flags.
  2. Enable for all beta users and monitor for a period of time.
  3. Ship to prod and monitor.
@langleyd langleyd self-assigned this Jan 13, 2022
@langleyd langleyd added the T-Enhancement New features, changes in functionality, performance boosts, user-facing improvements label Jan 13, 2022
@langleyd langleyd mentioned this issue Jan 21, 2022
6 tasks
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
T-Enhancement New features, changes in functionality, performance boosts, user-facing improvements
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant