CODEWITHSUNDEEP
oauth-2.0
NewbieCoder
NewbieCoder

Reputation: 377

Can I explicitly change expiry time of Access token generated from Authorization Code Grant Flow in OAuth 2?

In my application I am using OAuth 2 authorization and get access token from access code which expires after 8 hours. Is there any way I can increase this expiry time. Default expiry time I get is 28800(8 hours), I want it to be like for 30 days or 60 days. Is it possible. I know this is possible with Implicit grant flow but if I want to continue with Authorization code grant flow then, Is it possible?

Thanks.

Upvotes: 1

Views: 2300

Answers (2)

Daniel Dobalian
Daniel Dobalian

Reputation: 3237

You won't be able to modify the token itself as it's signed by the STS before being issued to you. If you were to modify the field itself, signature validation would fail when you bear the token. As dvsakgec said, this token is meant to be short lived and the correct pattern is to use the refresh token to obtain fresh access tokens when it has expired. For most identity providers, the refresh token never expires so you can always get a new access token.

Now, some identity providers will allow you to configure the token through their developer tools. It depends on the provider. There is no hard line guide for token expiration, it's whatever the identity provider decides.

Upvotes: 1

dvsakgec
dvsakgec

Reputation: 3774

You cannot increase the life of Access token beyond certain limit due to security reasons. These tokens are supposed to be short lived. One thing you can do is allowing issuance of refresh tokens for offline access. So, if access token is expired/about to expire, client (Secure) can talk to Authorization Server and get fresh access token issued.

Upvotes: 2

Related Questions