mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-06 09:13:19 +03:00
🚀 Feature: Refresh Tokens #304
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @savely-krasovsky on GitHub.
Originally assigned to: @kmendell on GitHub.
Feature description
OpenID Connect Refresh Tokens from the spec
Pitch
While I like Pocket ID a lot, I see that a lot of services/apps are actively trying to issue refresh tokens, but they can't since Pocket ID does not support them. Many SPA backends cannot issue cookie with own lifetime, but rather fully rely on access/refresh token mechanics, since they are basically advised to follow native applications best security practices. Source: https://www.ietf.org/archive/id/draft-ietf-oauth-browser-based-apps-24.html#name-browser-based-oauth-20-clie
I can probably try to contribute this feature, but I am not sure the project is ready/want to accept it. Maybe this is a principled position to keep project as simple as possible.
@savely-krasovsky commented on GitHub:
Yep, I understand that refresh tokens are fully optional by spec, but they are largely used in the wild. I see that Passkeys are much easier way to authorize, but it's still not convenient when for example every OAuth2 Proxy-protected resource asks me literally every hour to authorize again.
@kmendell commented on GitHub:
@stonith404 and i have talked about this from another issue (https://github.com/pocket-id/pocket-id/issues/250#issuecomment-2709808617). I think we were waiting on clarification for it. Though we will look into it more. It not a 'mandatory' item in the OIDC spec which if i had to guess is why it was not implemented. Ill see stonith has to say about it.