Make the session refresh lock duration, obtain timeout, and retry period
configurable via command-line flags, config file, or environment variables.
Previously, these values were hardcoded constants:
- sessionRefreshLockDuration = 2s
- sessionRefreshObtainTimeout = 5s
- sessionRefreshRetryPeriod = 10ms
This change removes the hardcoded constants and adds three new configuration
options to the Cookie configuration:
- `--session-refresh-lock-duration` (default: 2s)
- `--session-refresh-obtain-timeout` (default: 5s)
- `--session-refresh-retry-period` (default: 10ms)
The new options allow users to tune session refresh behavior for their
specific deployment requirements, such as:
- High-latency networks requiring longer timeouts
- High-throughput systems needing faster retry intervals
- Provider-specific refresh operation durations
Changes:
- Added SessionRefreshLockDuration, SessionRefreshObtainTimeout, and
SessionRefreshRetryPeriod fields to Cookie struct
- Updated StoredSessionLoaderOptions to accept these as parameters
- Modified storedSessionLoader to use configurable values instead of constants
- Updated all tests to provide default values
- Maintains full backward compatibility with original default values
Resolves TODO comments in pkg/middleware/stored_session.go
Signed-off-by: Kinfemichael Desse <kinfemichael.desse@real-digital.de>
* fix: invalidate session on fatal OAuth2 refresh errors
When a token refresh fails with a fatal OAuth2 error (invalid_grant,
invalid_client), the session is now cleared from the session store
and the cookie is removed, forcing re-authentication.
Previously, fatal refresh errors were logged but the stale session
continued to be served, leaving users logged in indefinitely after
their session was revoked at the provider level.
Transient errors (network timeouts, server errors) continue to
preserve the existing session as before.
Fixes#1945
Signed-off-by: Francesco Pasqualini <frapas@gmail.com>
* fix: apply review nits and add CHANGELOG entry
Signed-off-by: Francesco Pasqualini <frapas@gmail.com>
Signed-off-by: Jan Larwig <jan@larwig.com>
---------
Signed-off-by: Francesco Pasqualini <frapas@gmail.com>
Signed-off-by: Jan Larwig <jan@larwig.com>
* Improve logging for session refresh token status
Signed-off-by: Yosri Barhoumi <med.yosri.brh@gmail.com>
* doc: add changelog entry for #3327
Signed-off-by: Jan Larwig <jan@larwig.com>
* test: fix existing test cases for new behaviour
Signed-off-by: Jan Larwig <jan@larwig.com>
---------
Signed-off-by: Yosri Barhoumi <med.yosri.brh@gmail.com>
Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
Reorganized the structure of the Request Utils due to their widespread use
resulting in circular imports issues (mostly because of middleware & logger).
Kinfemichael Desse
Francesco Pasqualini
Yosri Barhoumi
Teko
Joel Speed
Kevin Kreitner
Nick Meves
Mitsuo Heijo
Phil Taprogge