Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove duplicated refresh token section #1188

Merged
merged 1 commit into from
Nov 26, 2018
Merged

Remove duplicated refresh token section #1188

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 1 addition & 12 deletions UPGRADE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,17 +283,6 @@ All method signatures stayed the same, but the factory names for instantiating t
`hydra.NewOAuth2Api()` is now `hydra.NewAdminApi()` and `hydra.NewPublicApi()` - depending on which endpoints you need
to interact with.

#### Refresh Token Expiry

All refresh tokens issued with this release will expire after 30 days of non-use. This behaviour can be modified
using the `REFRESH_TOKEN_LIFESPAN` environment variable. By setting `REFRESH_TOKEN_LIFESPAN=-1`, refresh tokens
are set to never expire, which is the previous behaviour.

Tokens issued before this change will still be valid forever.

We discourage setting `REFRESH_TOKEN_LIFESPAN=-1` as it might clog the database with tokens that will never be used again.
In high-scale systems, `REFRESH_TOKEN_LIFESPAN` should be set to something like 15 or 30 days.

#### JSON Web Token formatted Access Token data

Previously, extra fields coming from `session.access_token` where directly embedded in the OAuth 2.0 Access Token when
Expand All @@ -311,7 +300,7 @@ Use environment variables `HTTPS_TLS_CERT_PATH` and `HTTPS_TLS_KEY_PATH` instead

#### API Changes

Endpoint `/health/status`, which redirected to `/health/alive` and was deprecated has been removed.
Endpoint `/health/status`, which redirected to `/health/alive` was deprecated and has been removed.

## 1.0.0-beta.9

Expand Down