oauthgitlab

GitLab OAuth access token validity


Does anyone know what the expiration period of an OAuth Access Token on GitLab is?

It's at least 12 hours (from experience), but I would like to know for sure so I don't refresh the token unnecessary.

PS: GitLab ... it would be very convenient if the expiration is simply returned when getting/refreshing token (PS: the documentation states that "expires_in": is returned ... BUT IT ISN'T)


Solution

  • from https://forum.gitlab.com/t/missing-expires-in-in-the-token-response/1232/2:

    Gitlab uses Doorkeeper for oauth.

    The Doorkeeper wiki has an ariticle "Customizing Token Expiration" > https://github.com/doorkeeper-gem/doorkeeper/wiki/Customizing-Token-Expiration2

    This wiki tells us a configuration "access_token_expires_in". I > searched in gitlab source code and found it sets to nil.

    This meas the 'access_token' will never expire.

    Also, this is from https://gitlab.com/gitlab-org/gitlab-foss/-/blob/50d66f5ece57dcfbe074d97703691a8d3c38f4ac/config/initializers/doorkeeper.rb#L42:

     # Access token expiration time (default 2 hours).
     # If you want to disable expiration, set this to nil.
     access_token_expires_in nil