issue_comments: 1292708227

This data as json

html_url issue_url id node_id user created_at updated_at author_association body reactions issue performed_via_github_app
https://github.com/simonw/datasette/issues/1858#issuecomment-1292708227 https://api.github.com/repos/simonw/datasette/issues/1858 1292708227 IC_kwDOBm6k_c5NDSmD 9599 2022-10-26T22:05:34Z 2022-10-26T22:05:34Z OWNER

I just realized this can't easily affect the datasette create-token command because it doesn't currently accept the --setting option, so it wouldn't know what max_signed_tokens_ttl was.

More to the point: even if it did, someone could abuse their knowledge of the secret to create a signed non-expiring token even on servers that didn't want to support those.

So I actually need to redesign the token format: it needs to store the timestamp when the token was created and the intended duration, NOT the timestamp that the token expires at.

Otherwise it's not possible for servers to enforce max_signed_tokens_ttl - someone could always create a token with a custom expires_at timestamp on it outside of the configured limit.

 
{
    "total_count": 0,
    "+1": 0,
    "-1": 0,
    "laugh": 0,
    "hooray": 0,
    "confused": 0,
    "heart": 0,
    "rocket": 0,
    "eyes": 0
}
 1423364990