Skip to content

Implement Refresh Tokens #5292

@langleyd

Description

@langleyd

Add support for refresh token:
https://github.com/matrix-org/matrix-doc/blob/main/proposals/2918-refreshtokens.md
matrix-org/synapse#11427

Implementation Highlights:

  • We add the refresh_token parameter to login/register requests to receive a refresh_token(used to request new access tokens) and an access_token in addition to a expires_in_ms interval (to estimate client side when the token expires).
  • We should handle the cases where refresh_token is empty (server may not support refresh tokens or not have it enabled), expires_in_ms is empty ( the access token does not expire).
  • There is a /refresh endpoint where the refresh_token can be provided to gain a new access token.
  • Refresh tokens rotate, each time we call the refresh endpoint we also get a new refresh_token. Therefore we must be careful around the time of each refresh that if we have multiple concurrent requests we don't make multiple refresh requests or mishandle the new refresh_token.
  • We can preemptively refresh the token shortly before it expires to minimise any disruption to the user(waiting on the refresh request before a user request can be made). On iOS the server timeout we set on sync requests is 30s, so sometime like 60s seems reasonable for preemptive expiry.

Rollout plan:

  1. Distribute an alpha build(people have to explicitly download and can run side-by-side) to an initial set of internal users to test.
  2. Enable for all testflight beta users and monitor for a period of time.
  3. Ship to prod and monitor.

Metadata

Metadata

Assignees

Labels

T-EnhancementNew features, changes in functionality, performance boosts, user-facing improvements

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions