feat: regenerate active users token if it is expiring soon #5629
Conversation
alexmt
force-pushed
the
regenerate-account-login-tokens
branch
2 times, most recently
from
a8011fe to
b182fd4
Compare
server/server.go
Outdated
There was a problem hiding this comment.
Can you explain how this works? Is this is a new cookie key and why it needed in addition to the argocd-token?
There was a problem hiding this comment.
We need to somehow return regenerated token from the grpc service back to grpc gateway so it can be translated into the cookie.
GRPC provides outgoing server metadata for such purposes but GRPC gateway generates code that allows accessing only grpc-gateway.ServerMetadata that contains "headers" and "trailers" metadata.
So "Authenticate" method adds regenerated token into outgoing ServerMetadata.HeaderMD field. Then grpc-gateway response forwarder ( translateGrpcCookieHeader ) transforms this header into a proper cookie header
There was a problem hiding this comment.
Ah, I see. So it's not a key that a client is ever exposed to and is only used for internal purposes due to the way grpc-gateway works.
Do you mind adding a comment on how this works somewhere in the code for future reference?
There was a problem hiding this comment.
Sure. adding comment about it
Signed-off-by: Alexander Matyushentsev <[email protected]>
Signed-off-by: Alexander Matyushentsev <[email protected]>
alexmt
force-pushed
the
regenerate-account-login-tokens
branch
from
b182fd4 to
816510f
Compare
Codecov Report
@@ Coverage Diff @@
## master #5629 +/- ##
==========================================
+ Coverage 40.96% 40.97% +0.01%
==========================================
Files 144 144
Lines 19325 19344 +19
==========================================
+ Hits 7917 7927 +10
- Misses 10303 10310 +7
- Partials 1105 1107 +2
Continue to review full report at Codecov.
|
…5629) * feat: regenerate active users token if it is expiring soon Signed-off-by: Alexander Matyushentsev <[email protected]> * Comment how 'renew-token' header is used Signed-off-by: Alexander Matyushentsev <[email protected]>
3 participants
Signed-off-by: Alexander Matyushentsev [email protected]
PR is a follow-up for #5477 that introduced built-in token expiration. To make sure user experience is good API server will regenerate token for requests with valid token in case if token is expiring soon (5 minutes)