Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

document token ownership risks for Config.Client and ReuseTokenSource #672

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
+7 −1
Open

document token ownership risks for Config.Client and ReuseTokenSource #672

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
8 changes: 7 additions & 1 deletion oauth2.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,7 +235,8 @@ func (c *Config) Exchange(ctx context.Context, code string, opts ...AuthCodeOpti
}

// Client returns an HTTP client using the provided token.
// The token will auto-refresh as necessary. The underlying
// The token will auto-refresh as necessary using a ReuseTokenSource, and
// therefore should not be used directly after this call. The underlying
// HTTP transport will be obtained using the provided context.
// The returned client and its Transport should not be modified.
func (c *Config) Client(ctx context.Context, t *Token) *http.Client {
Expand Down Expand Up @@ -368,6 +369,11 @@ func NewClient(ctx context.Context, src TokenSource) *http.Client {
// same token as long as it's valid, starting with t.
// When its cached token is invalid, a new token is obtained from src.
//
// When used with tokens issued by a server implementing refresh token
// rotation the initial token t must be treated as owned by the returned
// TokenSource and not directly used further to avoid race conditions
// associated with refresh token invalidation.
//
// ReuseTokenSource is typically used to reuse tokens from a cache
// (such as a file on disk) between runs of a program, rather than
// obtaining new tokens unnecessarily.
Expand Down