advplyr
e56c1099e6
Add logout all devices button and extend auth logout endpoint
2026-07-24 17:44:03 -05:00
advplyr
c900676be7
User password changes invalidate sessions
2026-07-23 17:21:25 -05:00
advplyr and GitHub
e9b533637f
Merge pull request #5376 from DanielAshley/contrib/refresh-grace-period
...
Make refresh-token grace period configurable (default 10 min)
2026-07-22 18:01:32 -04:00
advplyr and GitHub
6458e6d3d2
Merge pull request #5387 from mikiher/fix/refresh-token-auth
...
Reject refresh tokens on API and WebSocket authentication
2026-07-21 18:20:57 -04:00
Daniel
95af4812cd
Make the refresh-token grace period configurable (default 10 min)
...
When /auth/refresh rotates the refresh token, the previous token is kept
valid for a short grace period so a client that never received the
rotation response (e.g. a dropped or suspended mobile request) can retry
with the old token and get back the already-rotated current token
instead of a 401.
That window was hardcoded to 60 seconds, which is too short for real
mobile conditions: iOS backgrounding, VPN/proxy timeouts, or network
handoff can delay the retry past a minute, permanently locking the
session out (#5281 ).
Make it configurable via REFRESH_TOKEN_GRACE_PERIOD (seconds), following
the existing REFRESH_TOKEN_EXPIRY / ACCESS_TOKEN_EXPIRY pattern, and
raise the default to 10 minutes. Adds unit tests for the new config.
Fixes #5281
2026-07-18 21:42:06 -04:00
mikiher
8ec547e302
fix(auth): refresh tokens authentication in API and WebSocket requests
2026-07-16 18:58:44 +03:00
mikiher
0ce37004af
fix(auth): harden OIDC web callback URL validation
2026-07-16 17:11:11 +03:00
mikiher
527745b54e
refactor(server): centralize request HTTPS and origin detection
2026-07-16 17:10:42 +03:00
Nicholas Wallace
e944b2a2f5
Add unique UUID to access and refresh tokens
2026-05-21 17:08:39 -07:00
advplyr and GitHub
cac74f3477
Merge pull request #5004 from nichwall/token_refresh_race_condition
...
Access token refresh grace period
2026-05-17 14:16:58 -05:00
advplyr
eee377e081
Cleanup TokenManager logs
2026-05-13 16:23:26 -05:00
advplyr
3942805129
Cleanup rotateTokensForSession
2026-04-30 16:25:43 -05:00
advplyr
379f6c716a
Merge branch 'master' into token_refresh_race_condition
2026-04-30 15:59:22 -05:00
advplyr
874e9e1856
Update API Key jwtAuthCheck to check user active status
2026-03-18 16:17:45 -05:00
Nicholas Wallace
cfeb6bd502
Fix: grace period enable statement
2026-01-24 18:57:40 -07:00
Nicholas Wallace
077b523bd6
Fix JS Doc deletion
2026-01-24 18:42:50 -07:00
Nicholas Wallace
b8a2d113f0
Allow rotation without grace period for invalidating all user sessions
2026-01-24 18:26:11 -07:00
Nicholas Wallace
e1ae4f2d31
Fix: race condition in rotation
2026-01-24 18:10:38 -07:00
Nicholas Wallace
7aa2f84daa
Revert default token expiry
2026-01-24 17:00:07 -07:00
Nicholas Wallace
da0a64daed
Add: 10 second grace period to access token cycle
2026-01-24 16:57:25 -07:00
Finn Dittmar
0a4de61eff
Chnage Auth Expiry
2025-10-19 09:22:12 +02:00
Vito0912
50e2fe7fd2
Fix http/https error
2025-08-30 17:47:21 +02:00
advplyr
4018be6330
Fix oidc auto-register not cleaning up new user on errors #4563
2025-08-10 17:26:15 -05:00
advplyr
99a3867ce9
Update callback url check
...
Co-authored-by: Denis Arnst <git@sapd.eu >
2025-08-10 17:08:25 -05:00
advplyr
f7b94a4b6d
Fix OIDC auto register user #4485
2025-07-13 17:04:02 -05:00
advplyr
7d6d3e6687
Move invalidate refresh token to TokenManager
2025-07-11 14:43:07 -05:00
advplyr
8775e55762
Update jwt secret handling
2025-07-08 16:39:50 -05:00
advplyr
9c8900560c
Seperate out auth strategies, update change password to return error status codes
2025-07-07 15:04:40 -05:00
advplyr
97afd22f81
Refactor Auth to breakout functions in TokenManager, handle token generation for OIDC
2025-07-06 16:43:03 -05:00
advplyr