finn/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add option to disable refresh token invalidation (#6584)

Browse source 
* Add option to disable refresh token invalidation

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Add integration tests and remove wrong todos

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Fix typo

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Fix tests and add documentation

Signed-off-by: Jonas Franz <info@jonasfranz.software>
This commit is contained in:
Jonas Franz 2019-04-12 09:50:21 +02:00 • committed by Lunny Xiao
parent 3ff0a126e1
commit 783cd64927
6 changed files with 57 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

1
modules/auth/user_form.go
View file

@ -172,7 +172,6 @@ type AccessTokenForm struct {
ClientID string
ClientSecret string
RedirectURI string
// TODO Specify authentication code length to prevent against birthday attacks
Code string
RefreshToken string

2
modules/setting/setting.go
View file

@ -304,12 +304,14 @@ var (
Enable bool
AccessTokenExpirationTime int64
RefreshTokenExpirationTime int64
InvalidateRefreshTokens bool
JWTSecretBytes []byte `ini:"-"`
JWTSecretBase64 string `ini:"JWT_SECRET"`
}{
Enable: true,
AccessTokenExpirationTime: 3600,
RefreshTokenExpirationTime: 730,
InvalidateRefreshTokens: false,
}
U2F = struct {