Session docs overstate expiry: no default lifetime, and invalidation clears fields rather than deleting the row
Maintainers usually reply within 1 day
@heskew is already working on this.
Since Oct 2, 2026.
Assessment
This issue has not been assessed yet.
Description
docs/token-refresh-and-sessions.md (around line 141) says Harper sessions "default 24 hours" and that an expired session "is deleted from hdb_session". Neither is accurate:
- Harper sessions have no default expiry.
- When the plugin invalidates an OAuth session, it clears the session's
oauth/userfields rather than deleting the row.
This matters for security reasoning. Operators reading the doc will underestimate how long a session can live, which is the premise behind #231 §1 (neutralizing pre-gate sessions) and #273 (a held roleless session inheriting a role later).
Fix:
- State the actual lifetime: no expiry unless the app sets one.
- Describe what invalidation clears.
- Point to the interim mitigation of clearing
system.hdb_sessionwhere relevant. - Grep the other docs for the same claim.
- Dominant language
- JavaScript
- Stars
- 1
- Forks
- 3
- Avg merge
- 1d 58m
- Merged PRs (30d)
- 25
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from HarperFast/oauth
-
Exclude OAuth authentication resources from native MCP toolsPossibly taken @hdbjeff claimed this 1 day ago. Openbug
HarperFast/oauth#281 · 1 assignee ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 18/100
HarperFast/oauth#280 ·
Maintainers usually reply within 1 day
-
MCP OAuth (mcp: true / withMCPAuth) does not populate context.user for Harper core's native /mcp endpointPossibly taken @kriszyp claimed this 3 days ago. Open
HarperFast/oauth#279 · 1 assignee ·
Maintainers usually reply within 1 day
-
Open-issue triage and roadmap (post-2.9.0)Possibly taken @heskew claimed this 17 days ago. Open
HarperFast/oauth#278 · 1 assignee ·
Maintainers usually reply within 1 day
-
Azure ?appid= form of the shared-alias keys URL isn't recognizedPossibly taken @heskew claimed this 17 days ago. Open
HarperFast/oauth#275 · 1 assignee ·
Maintainers usually reply within 1 day
All issues in HarperFast/oauth
Similar issues
-
task
Difficulty 1/5 Under an hour Newbie friendliness 83/100
TAMULib/fw-registry#550 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
-
NWCWalletService.subscribe: response is never published if the handler finishes after unsubscribe (regression in 8.1.0)Possibly taken @ajaysehwal claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
bigskysoftware/htmx#4151 ·
Maintainers usually reply within 4 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100