Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

document token ownership risks for Config.Client and ReuseTokenSource #672

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

document token ownership risks for Config.Client and ReuseTokenSource #672

wants to merge 1 commit into from
+7 −1

Commits on Sep 28, 2023

  1. document token ownership requirements for Config.Client and ReuseToke… 

    …nSource

When used with tokens issued by a server supporting refresh token rotation it is unsafe to continuing using the token provided to ReuseTokenSource (including via the Client method of Config) outside of the returned TokenSource and/or Client as it leads to a race condition when the first renewal happens:

* If ReuseTokenSource renews its token first, the original token's RefreshToken is now invalid (revoked) and any use/renewal attempt will fail. 
* If the original token renews its token first, the ReuseTokenSource holds the invliad RefreshToken and will fail on the next usage attempt.

golang#84 has extensive discussion of related risks and complications when trying to cache or store the RefreshToken, but the generic risk of race conditions exists regardless of whether any caching or storage is being attempted and API users must be warned of this possibility.
    @mattbnz
    mattbnz committed Sep 28, 2023
    Configuration menu
    Copy the full SHA
    a03b4ae View commit details
    Browse the repository at this point in the history