Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Periodically expire appInfo from storage #2562

Open
tsmethurst opened this issue Jan 16, 2024 · 1 comment
Open

Periodically expire appInfo from storage #2562

tsmethurst opened this issue Jan 16, 2024 · 1 comment
Labels
c: feature Request for new feature

Comments

@tsmethurst
Copy link

Currently as far as I can tell, Elk keeps appInfo / oauth application tokens in storage indefinitely or until the Elk operator takes an action to clear appInfo (or restarts Elk, if storage driver is memory, presumably).

This avoids spamming instances with lots of app creation POST requests, which is nice, but it also means that if an instance admin invalidates the elk app on their side, then no users will be able to log in via an elk instance that had already been logged in to previously, because that elk instance will keep trying to reuse the now invalidated app token.

So to illustrate:

  1. User1 signs in to elk.zone from their example.org instance (app token is created via POST to /api/v1/apps, and stored by elk.zone).
  2. An admin of the example.org instance invalidates apps created on their instance for whatever reason (periodic cleanup, worries about privacy/security, accidental data loss, whatever).
  3. User1 tries to sign in to elk.zone again. elk.zone tries to create a user-level OAuth token request using the appInfo stored by elk.zone, but this fails because the appInfo now only exists on elk.zone and does not correspond to an application on example.org.
  4. User1 can now never sign in to elk.zone from example.org.

To solve this issue, perhaps it would be worth expiring stored appInfo every x amount of time (once every two weeks? once a month?). This will lead to more app tokens being created overall on Mastodon (and other types of) instances, but at least it means users won't be locked out of using elk.zone indefinitely.

@tsmethurst tsmethurst added the s: pending triage Pending Triage label Jan 16, 2024
Copy link

stackblitz bot commented Jan 16, 2024

Solve in StackBlitz Codeflow Start a new pull request in StackBlitz Codeflow.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c: feature Request for new feature
Projects
None yet
Development

No branches or pull requests

2 participants