Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

User token stops working 8 hours after /github connect (classic OAuth App)

Offen
  • Stimmt etwas nicht?
#1,069 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
52/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
github, go
Bereich
authentication, backend

Rechercherichtung

Start with the OAuth flow and token storage around server/plugin/plugin.go, then inspect server/plugin/graphql/client.go and the existing mm_34646_token_refresh.go reset path. Confirm whether GitHub returns expires_in and refresh_token for this OAuth flow, then reproduce the failure and identify the point where refresh handling and tests should be added. Done means expiring tokens are refreshed before the next GitHub call, revoked-token behavior remains covered, and relevant tests pass.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

On our self-hosted Mattermost, the token the plugin gets from /github connect stops working about 8 hours later. From then on every GitHub call returns 401 Bad credentials, and the next morning the daily reminder triggers the “Your Github account was disconnected due to an invalid or revoked authorization token” DM.

Environment
  • Mattermost Team Edition 11.11.1 (since upgraded to 12.0.0)
  • GitHub plugin 2.6.0
  • A classic OAuth App owned by our organization, not a GitHub App. Its settings page has no token expiration option.
  • One connected user, a bot account
Timing
Connect (UTC) First 401 (UTC) Lifetime
13 Oct 07:29:36 13 Oct 15:30:11 8h 00m
14 Oct 07:58:04 14 Oct 16:15:51 8h 17m
15 Oct 06:20:15 15 Oct 14:31:47 8h 11m
16 Oct 08:33:43 16 Oct 16:35:11 8h 01m

Connect times come from the account’s security log (oauth_access.create), 401 times from the plugin’s Failed to search for the sidebar data errors. The 401 appears at the first plugin call after the 8 hours, which explains the extra minutes.

What we ruled out
  • The MM-34646 reset in mm_34646_token_refresh.go. It skips users who connected through /github connect, since those get MM34646ResetTokenDone: true, and its Updated user access token for MM-34646 debug line never appears in our logs.
  • Revocation. The security log has no oauth_authorization.destroy, password change or 2FA change. It does have an oauth_access.regenerate by “GitHub System” within a second of every oauth_access.create, but that also happens for an unrelated integration (Copilot), so it looks like part of normal token issuance.
  • Mattermost itself. No restart or plugin configuration change around the first failure.
Suggestion

Eight hours is the lifetime of GitHub’s expiring user tokens. If GitHub now issues those to OAuth Apps too, the plugin needs to keep the refresh token and refresh on expiry. Today it wraps the stored token in oauth2.StaticTokenSource (server/plugin/plugin.go, server/plugin/graphql/client.go), so it never refreshes. We inferred the 8 hours from the timings above and haven’t inspected the token response for expires_in or refresh_token. Can anyone confirm whether GitHub changed this for classic OAuth Apps?

Vorherrschende Sprache
Go
Sterne
181
Forks
181
Ø Merge
22 Std. 10 Min.
Gemergte PRs (30 T.)
5

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus mattermost/mattermost-plugin-github

Alle Issues in mattermost/mattermost-plugin-github

Ähnliche Issues

Weitere Issues zu Go

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.