Yicong-Huang commented on issue #3737: URL: https://github.com/apache/texera/issues/3737#issuecomment-5135819007
Revisiting this topic, I’m curious about the specific security concern with the refresh-token approach. If a new access token is issued only when the user’s account is still active in the system, wouldn’t this allow us to immediately stop token renewal after the account is disabled or revoked? This would preserve long-running sessions for active users while still allowing the system to terminate access centrally when necessary. Is the remaining concern that a stolen refresh token could continue to be used indefinitely as long as the account remains active? If so, could refresh-token rotation, revocation, and an absolute session lifetime address that risk without requiring every user to log in again periodically? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
