opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-21 12:44:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: ensure OAuth2 refresh tokens outlive access tokens (#19769)

Browse Source
This commit is contained in:
Thomas Kosiewski
2025-09-13 08:57:26 +02:00
committed by GitHub
parent be7aa58075
commit 088d14933c
15 changed files with 229 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/api/general.md
Generated
+2 -1
View File
@@ -442,7 +442,8 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
"default_token_lifetime": 0,
"disable_expiry_refresh": true,
"max_admin_token_lifetime": 0,
"max_token_lifetime": 0
"max_token_lifetime": 0,
"refresh_default_duration": 0
},
"ssh_keygen_algorithm": "string",
"strict_transport_security": 0,
docs/reference/api/schemas.md
Generated
+14 -10
View File
@@ -2466,7 +2466,8 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
"default_token_lifetime": 0,
"disable_expiry_refresh": true,
"max_admin_token_lifetime": 0,
"max_token_lifetime": 0
"max_token_lifetime": 0,
"refresh_default_duration": 0
},
"ssh_keygen_algorithm": "string",
"strict_transport_security": 0,
@@ -2953,7 +2954,8 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
"default_token_lifetime": 0,
"disable_expiry_refresh": true,
"max_admin_token_lifetime": 0,
"max_token_lifetime": 0
"max_token_lifetime": 0,
"refresh_default_duration": 0
},
"ssh_keygen_algorithm": "string",
"strict_transport_security": 0,
@@ -6867,19 +6869,21 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
"default_token_lifetime": 0,
"disable_expiry_refresh": true,
"max_admin_token_lifetime": 0,
"max_token_lifetime": 0
"max_token_lifetime": 0,
"refresh_default_duration": 0
}
```
### Properties
| Name | Type | Required | Restrictions | Description |
|----------------------------|---------|----------|--------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `default_duration` | integer | false | | Default duration is only for browser, workspace app and oauth sessions. |
| `default_token_lifetime` | integer | false | | |
| `disable_expiry_refresh` | boolean | false | | Disable expiry refresh will disable automatically refreshing api keys when they are used from the api. This means the api key lifetime at creation is the lifetime of the api key. |
| `max_admin_token_lifetime` | integer | false | | |
| `max_token_lifetime` | integer | false | | |
| Name | Type | Required | Restrictions | Description |
|----------------------------|---------|----------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `default_duration` | integer | false | | Default duration is only for browser, workspace app and oauth sessions. |
| `default_token_lifetime` | integer | false | | |
| `disable_expiry_refresh` | boolean | false | | Disable expiry refresh will disable automatically refreshing api keys when they are used from the api. This means the api key lifetime at creation is the lifetime of the api key. |
| `max_admin_token_lifetime` | integer | false | | |
| `max_token_lifetime` | integer | false | | |
| `refresh_default_duration` | integer | false | | Refresh default duration is the default lifetime for OAuth2 refresh tokens. This should generally be longer than access token lifetimes to allow refreshing after access token expiry. |
## codersdk.SlimRole
docs/reference/cli/server.md
Generated
+11
View File
@@ -932,6 +932,17 @@ The maximum lifetime duration administrators can specify when creating an API to
The default lifetime duration for API tokens. This value is used when creating a token without specifying a duration, such as when authenticating the CLI or an IDE plugin.
### --default-oauth-refresh-lifetime
| | |
|-------------|----------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_DEFAULT_OAUTH_REFRESH_LIFETIME</code> |
| YAML | <code>defaultOAuthRefreshLifetime</code> |
| Default | <code>720h0m0s</code> |
The default lifetime duration for OAuth2 refresh tokens. This controls how long refresh tokens remain valid after issuance or rotation.
### --swagger-enable
| | |