mirror of
https://github.com/advplyr/audiobookshelf.git
synced 2026-07-25 02:31:39 +00:00
95af4812cd
When /auth/refresh rotates the refresh token, the previous token is kept valid for a short grace period so a client that never received the rotation response (e.g. a dropped or suspended mobile request) can retry with the old token and get back the already-rotated current token instead of a 401. That window was hardcoded to 60 seconds, which is too short for real mobile conditions: iOS backgrounding, VPN/proxy timeouts, or network handoff can delay the retry past a minute, permanently locking the session out (#5281). Make it configurable via REFRESH_TOKEN_GRACE_PERIOD (seconds), following the existing REFRESH_TOKEN_EXPIRY / ACCESS_TOKEN_EXPIRY pattern, and raise the default to 10 minutes. Adds unit tests for the new config. Fixes #5281 |
||
|---|---|---|
| .. | ||
| auth | ||
| controllers | ||
| finders | ||
| libs | ||
| managers | ||
| migrations | ||
| models | ||
| objects | ||
| providers | ||
| routers | ||
| scanner | ||
| utils | ||
| Auth.js | ||
| Database.js | ||
| Logger.js | ||
| Server.js | ||
| SocketAuthority.js | ||
| Watcher.js | ||