Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Add cleanup for rotated OAuth token records

Aperta
  • Qualcosa non va?
#2,340 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
csharp
Ambito
authentication, databases

Direzione di ricerca

Start by tracing the OAuth authorization-code exchange, refresh, grant revocation, and grants UI paths mentioned in the issue; identify where token documents are created, disabled, queried, and deleted. Then review the existing tests around those flows before deciding how cleanup preserves replay detection and grant-family behavior. Done means expired disabled records are cleaned up safely, frequent refreshes do not accumulate unbounded records, and focused rotation/cleanup tests pass.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

OAuth refresh token rotation currently creates a new OAuthToken document on every successful refresh. The previous token is disabled, but it remains in the oauth-tokens index. I did not find a cleanup path for expired or disabled OAuth token documents except deleting all tokens for a user.

This means active OAuth grants can grow the oauth-tokens index indefinitely over time. It also makes grant-family operations more fragile because revocation currently pages grant-family tokens with a fixed limit.

Current behavior

  • Authorization code exchange creates an OAuthToken document.
  • Refresh finds the token by RefreshTokenHash.
  • The spent token is disabled.
  • A new OAuthToken document is created with the same GrantId.
  • Disabled/spent token documents are retained indefinitely unless the user is deleted or all user tokens are removed.

Desired outcome

Add cleanup or compaction so rotated OAuth token records do not grow forever.

A reasonable policy would be:

  • Keep the active token for each grant.
  • Remove disabled/spent OAuth token records once they are no longer needed.
  • If spent refresh-token hashes are retained for replay detection, only keep them until the relevant refresh-token expiry plus a small safety window.
  • Ensure grant revocation and the user's OAuth grants UI continue to work correctly even after old rotated rows are cleaned up.

Notes

Once a token has been refreshed, the old access token is no longer useful. The only possible reason to retain the old row is refresh-token replay detection because the old row may still contain the spent refresh-token hash. If we want that protection, retention should be bounded by RefreshExpiresUtc, not indefinite.

Acceptance criteria

  • Expired disabled OAuth token documents are cleaned up or compacted automatically.
  • Cleanup is safe for refresh-token replay detection, or the product explicitly accepts not retaining spent refresh-token hashes.
  • A grant that refreshes frequently does not accumulate unbounded token documents.
  • Grant-family revocation remains reliable even for long-lived/high-refresh grants.
  • Add focused tests for refresh rotation plus cleanup behavior.
Lingua principale
C#
Stelle
2.5k
Fork
508
Merge medio
2g 17h
PR unite (30g)
40

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di exceptionless/Exceptionless

Tutte le issue di exceptionless/Exceptionless

Issue simili

Altre issue su C#

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.