Open Closed

Prolong token lifetime per each request #373


User avatar
0
alexander.nikonov created
  • ABP Framework version: v2.9
  • UI type: Angular
  • Tiered (MVC) or Identity Server Separated (Angular): Identity Server Separated

Hi, we can see that meanwhile token lifetime is not prolonged per each request in UI, there is a fixed lifetime that is configured (1 year by default for now, as far as I remember). We want to provide a specific token life, like 15 mins and to prolong token lifetime per each request by this value. How would you recommend to do that?


10 Answer(s)
  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    Hi,

    You can set the expiration time and use the refresh token to get a new access token

  • User Avatar
    0
    alexander.nikonov created

    Hi, could you please make a short test example how to work with refresh_token? In current implementation (built from ABP template) we use only access_token.

  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    Hi,

    Please see the document: https://identityserver4.readthedocs.io/en/latest/topics/refresh_tokens.html

  • User Avatar
    0
    alexander.nikonov created

    Good, but from ABP-based project's prospective, does it need to be something like this in front-end part: Angular Refresh Token implementation and from back-end part probably nothing needs to be added to make it work?

  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    Yes, you don't need to change back-end code.

  • User Avatar
    0
    alexander.nikonov created

    OK. We implemented service on Angular side and seems like everything works now.

  • User Avatar
    0
    alexander.nikonov created

    I can't close this ticket yet, because after installing ABP 3.2, where the authentication workflow has been changed, our refresh token funcitonality does not work anymore - user is not logged off after refresh interval passes.

    We would like to know in details, how exactly the corresponding functionality has been changed since the previous ABP versions and how our code needs to be adopted to make token work again.

  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    Hi

    Now, we are using code flow. but you can still get the refresh token

  • User Avatar
    0
    alexander.nikonov created

    OK, thanks. Where the refresh_token lifetime is set?

  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    HI,

    You can see the IdentityServerDataSeedContributor.cs in the domain project

    You can also use the IClientRepository to update client.

    var client = await _clientRepository.FindAsync(xx);
    
    client.AbsoluteRefreshTokenLifetime = ....;
    
    await _clientRepository.UpdateAsync(client);
    
Made with ❤️ on ABP v9.1.0-preview. Updated on November 01, 2024, 05:35