Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Add cleanup for rotated OAuth token records

未关闭
  • 哪里不对？
#2,340 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
冷清
技术栈
csharp
领域
authentication, databases

调研方向

Start by tracing the OAuth authorization-code exchange, refresh, grant revocation, and grants UI paths mentioned in the issue; identify where token documents are created, disabled, queried, and deleted. Then review the existing tests around those flows before deciding how cleanup preserves replay detection and grant-family behavior. Done means expired disabled records are cleaned up safely, frequent refreshes do not accumulate unbounded records, and focused rotation/cleanup tests pass.

由索引模型根据 Issue 内容生成。

描述

Problem

OAuth refresh token rotation currently creates a new OAuthToken document on every successful refresh. The previous token is disabled, but it remains in the oauth-tokens index. I did not find a cleanup path for expired or disabled OAuth token documents except deleting all tokens for a user.

This means active OAuth grants can grow the oauth-tokens index indefinitely over time. It also makes grant-family operations more fragile because revocation currently pages grant-family tokens with a fixed limit.

Current behavior

  • Authorization code exchange creates an OAuthToken document.
  • Refresh finds the token by RefreshTokenHash.
  • The spent token is disabled.
  • A new OAuthToken document is created with the same GrantId.
  • Disabled/spent token documents are retained indefinitely unless the user is deleted or all user tokens are removed.

Desired outcome

Add cleanup or compaction so rotated OAuth token records do not grow forever.

A reasonable policy would be:

  • Keep the active token for each grant.
  • Remove disabled/spent OAuth token records once they are no longer needed.
  • If spent refresh-token hashes are retained for replay detection, only keep them until the relevant refresh-token expiry plus a small safety window.
  • Ensure grant revocation and the user's OAuth grants UI continue to work correctly even after old rotated rows are cleaned up.

Notes

Once a token has been refreshed, the old access token is no longer useful. The only possible reason to retain the old row is refresh-token replay detection because the old row may still contain the spent refresh-token hash. If we want that protection, retention should be bounded by RefreshExpiresUtc, not indefinite.

Acceptance criteria

  • Expired disabled OAuth token documents are cleaned up or compacted automatically.
  • Cleanup is safe for refresh-token replay detection, or the product explicitly accepts not retaining spent refresh-token hashes.
  • A grant that refreshes frequently does not accumulate unbounded token documents.
  • Grant-family revocation remains reliable even for long-lived/high-refresh grants.
  • Add focused tests for refresh rotation plus cleanup behavior.
主要语言
C#
星标
2.5k
派生
508
平均合并
2 天 17 小时
30 天内合并 PR
40

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

exceptionless/Exceptionless 的其他 Issue

查看 exceptionless/Exceptionless 的全部 Issue

相似的 Issue

更多 C# Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。