SaveTokensAsClaims defaults

[leastprivilege]

Storing the expires_in is not very useful. I'd rather store an expires_at claim and add the seconds to the current time.

I am also not sure if the SaveTokensAsClaims should default to true.

[brentschmaltz]

Since expires_in is a relative term, it is difficult to determine when the item has expired. expires_at is easier to work with.

[Eilon]

Is this about changing the default value of SaveTokensAsClaims to false only for the OIDC provider? But perhaps leaving it true for the other providers (e.g. OAuth)?

As an aside, we also need to promote this property into RemoteAuthenticationOptions because all the current sub-classes of that type independently add the property.

[Eilon]

We're going to change the default back to false because having it on by default causes too many problems. In reality, many common scenarios also need to use something like claims transformation to limit the tokens that get saved anyway, so a one-stop action often won't work anyway.

[kevinchalet]

We're going to change the default back to false because having it on by default causes too many problems.

Interesting. Do you have a concrete example in mind?

Personally, I'm fine changing the default value to false for both the OIDC middleware and the OAuth2 base middleware (all the social providers already use false by default: #257 (comment)), as long as SaveTokensAsClaims remains a first-class citizen 👍

[brockallen]

Perhaps some of the problems are the bloat from the protocol claims (nonce, etc). Those, most likely, can be always filtered from the claims.

[Eilon]

The bloat was the main problem. Serializing the full set of claims from OIDC can be huge, and most often breaks Safari. Having different defaults amongst different providers could also be a bit confusing. We talked about filtering out certain claims but I have a feeling that might also be confusing.

[HaoK]

f24c35f