From 45de2c6645b7b8d33a2b2d616c3cb3dd1bd79987 Mon Sep 17 00:00:00 2001 From: Willy Kloucek Date: Fri, 18 Nov 2022 15:02:02 +0100 Subject: [PATCH] lower default access / id / refresh token lifespans --- services/idp/pkg/config/config.go | 8 ++++---- services/idp/pkg/config/defaults/defaultconfig.go | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/services/idp/pkg/config/config.go b/services/idp/pkg/config/config.go index 515b6970c3..67ea0c296c 100644 --- a/services/idp/pkg/config/config.go +++ b/services/idp/pkg/config/config.go @@ -111,8 +111,8 @@ type Settings struct { CookieBackendURI string CookieNames []string - AccessTokenDurationSeconds uint64 `yaml:"access_token_duration_seconds" env:"IDP_ACCESS_TOKEN_EXPIRATION" desc:"Expiration time in seconds for IDP access token."` - IDTokenDurationSeconds uint64 `yaml:"id_token_duration_seconds" env:"IDP_ID_TOKEN_EXPIRATION" desc:"Expiration time in seconds for IDP ID tokens."` - RefreshTokenDurationSeconds uint64 `yaml:"refresh_token_duration_seconds" env:"IDP_REFRESH_TOKEN_EXPIRATION" desc:"Expiration time in seconds for refresh tokens."` - DyamicClientSecretDurationSeconds uint64 `yaml:"dynamic_client_secret_duration_seconds" env:"IDP_DYNAMIC_CLIENT_SECRET_DURATION" desc:"Expiration time in seconds for dynamic clients."` + AccessTokenDurationSeconds uint64 `yaml:"access_token_duration_seconds" env:"IDP_ACCESS_TOKEN_EXPIRATION" desc:"'Access token lifespan in seconds (time before an access token is expired).'"` + IDTokenDurationSeconds uint64 `yaml:"id_token_duration_seconds" env:"IDP_ID_TOKEN_EXPIRATION" desc:"ID token lifespan in seconds (time before an ID token is expired)."` + RefreshTokenDurationSeconds uint64 `yaml:"refresh_token_duration_seconds" env:"IDP_REFRESH_TOKEN_EXPIRATION" desc:"Refresh token lifespan in seconds (time before an refresh token is expired). This also limits the duration of an idle offline session."` + DyamicClientSecretDurationSeconds uint64 `yaml:"dynamic_client_secret_duration_seconds" env:"IDP_DYNAMIC_CLIENT_SECRET_DURATION" desc:"Lifespan in seconds of a dynamically registered OIDC client."` } diff --git a/services/idp/pkg/config/defaults/defaultconfig.go b/services/idp/pkg/config/defaults/defaultconfig.go index fbd928be42..ab9c730e3c 100644 --- a/services/idp/pkg/config/defaults/defaultconfig.go +++ b/services/idp/pkg/config/defaults/defaultconfig.go @@ -61,9 +61,9 @@ func DefaultConfig() *config.Config { ValidationKeysPath: "", CookieBackendURI: "", CookieNames: nil, - AccessTokenDurationSeconds: 60 * 60 * 24, // 1 day - IDTokenDurationSeconds: 60 * 60, // 1 hour - RefreshTokenDurationSeconds: 60 * 60 * 24 * 365 * 3, // 1 year + AccessTokenDurationSeconds: 60 * 5, // 5 minutes + IDTokenDurationSeconds: 60 * 5, // 5 minutes + RefreshTokenDurationSeconds: 60 * 60 * 24 * 30, // 30 days DyamicClientSecretDurationSeconds: 0, }, Clients: []config.Client{