diff options
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub/config.py')
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/config.py | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/config.py b/packages/meshbay-hub/src/meshbay_hub/config.py index 31912d1..b508e45 100644 --- a/packages/meshbay-hub/src/meshbay_hub/config.py +++ b/packages/meshbay-hub/src/meshbay_hub/config.py @@ -46,7 +46,18 @@ class HubIdentityConfig: @dataclass class JWTConfig: - access_token_ttl: int = 3600 # 1 hour + # How long an access token stays good. It is not the session — the refresh + # token below is, and the SPA renews against it well before this runs out, + # so a film or a working day never meets this number. + # + # What it does bound is a token that leaks: revoking a member or suspending + # an account both take effect at once (the hub reloads the account on every + # request, and pushes signed revocations to nodes), but there is no way to + # kill one issued token short of that. Four hours keeps the window short + # while renewing several times a day — which also means the renewal path is + # exercised constantly rather than twice, and cannot rot unnoticed the way + # it did when nothing used it at all. + access_token_ttl: int = 14400 # 4 hours refresh_token_ttl: int = 86400 * 30 # 30 days |