At the moment a number of active/valid access tokens is unlimited which allows opening multiple "sessions" in, let's say, several browsers. The https://www.drupal.org/project/session_limit module allows preventing this for regular sessions but it won't fit the need for OAuth.

CommentFileSizeAuthor
#2 3051358-do-not-commit.patch4.08 KBbr0ken

Comments

BR0kEN created an issue. See original summary.

br0ken’s picture

br0ken
Primary language Ukrainian
commented
Status: Active » Needs work
Issue tags: +Needs tests
StatusFileSize
new 3051358-do-not-commit.patch4.08 KB

PoC

br0ken’s picture

br0ken
Primary language Ukrainian
commented

@e0ipso, what is the best way to locate a corresponding refresh token by an access token?

br0ken’s picture

br0ken
Primary language Ukrainian
commented
Status: Needs work » Needs review
e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
commented

@e0ipso, what is the best way to locate a corresponding refresh token by an access token?

I can't remember at the moment. I kind of think that we've had issues around this in the past.

e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
commented

This patch:

  • Adds a configuration object and the necessary form.
  • Implements hook_entity_insert.

This makes it a good candidate for a separate contrib. @BR0kEN have you considered that approach? I'll be happy to link to it in the project page.

br0ken’s picture

br0ken
Primary language Ukrainian
commented

I was thinking about a submodule (kinda `simple_oauth_tokens_limit`) but came up that simply having a default configuration that disables the feature is enough since it does not introduce any breaking changes.

So, by default `simple_oauth` behaves as it was before. Then, only when someone changes the configuration, it starts limiting access tokens.

@e0ipso, are you against implementing this in `simple_oauth` or should I propose another approach?

e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
commented

@BR0kEN I think this is a very valid feature. However, as you well know, this module already has MANY features to maintain. I am quite choosy on what gets in. One key factor I consider is does this benefit the majority of the installs? In this case I think the feature is very useful, but not everyone will need it. That's why I'm reticent to have to maintain it (as an optional feature).

bradjones1’s picture

bradjones1
Primary language English
commented
Version: 8.x-3.x-dev » 5.x-dev
Status: Needs review » Active

Agreed that this might be useful to some but probably belongs in a separate contrib module in this ecosystem. Marking as active and bumping versions.

ssob_ii’s picture

ssob_ii commented

How can I add this file into my code?

bojan_dev’s picture

bojan_dev commented
Assigned: br0ken » Unassigned
Status: Active » Closed (won't fix)

Closing this issue because we do not plan to support this feature in simple_oauth.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.