You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently as far as I can tell, Elk keeps appInfo / oauth application tokens in storage indefinitely or until the Elk operator takes an action to clear appInfo (or restarts Elk, if storage driver is memory, presumably).
This avoids spamming instances with lots of app creation POST requests, which is nice, but it also means that if an instance admin invalidates the elk app on their side, then no users will be able to log in via an elk instance that had already been logged in to previously, because that elk instance will keep trying to reuse the now invalidated app token.
So to illustrate:
User1 signs in to elk.zone from their example.org instance (app token is created via POST to /api/v1/apps, and stored by elk.zone).
An admin of the example.org instance invalidates apps created on their instance for whatever reason (periodic cleanup, worries about privacy/security, accidental data loss, whatever).
User1 tries to sign in to elk.zone again. elk.zone tries to create a user-level OAuth token request using the appInfo stored by elk.zone, but this fails because the appInfo now only exists on elk.zone and does not correspond to an application on example.org.
User1 can now never sign in to elk.zone from example.org.
To solve this issue, perhaps it would be worth expiring stored appInfo every x amount of time (once every two weeks? once a month?). This will lead to more app tokens being created overall on Mastodon (and other types of) instances, but at least it means users won't be locked out of using elk.zone indefinitely.
The text was updated successfully, but these errors were encountered:
Currently as far as I can tell, Elk keeps appInfo / oauth application tokens in storage indefinitely or until the Elk operator takes an action to clear appInfo (or restarts Elk, if storage driver is memory, presumably).
This avoids spamming instances with lots of app creation POST requests, which is nice, but it also means that if an instance admin invalidates the elk app on their side, then no users will be able to log in via an elk instance that had already been logged in to previously, because that elk instance will keep trying to reuse the now invalidated app token.
So to illustrate:
To solve this issue, perhaps it would be worth expiring stored appInfo every x amount of time (once every two weeks? once a month?). This will lead to more app tokens being created overall on Mastodon (and other types of) instances, but at least it means users won't be locked out of using elk.zone indefinitely.
The text was updated successfully, but these errors were encountered: