3 ms·
This looks great! How is revocation handled? Will a proxy using sharewith as an oidc provider hit the authz graph on every request?
by evancordell 6y ago
This looks great!
How is revocation handled? Will a proxy using sharewith as an oidc provider hit the authz graph on every request?
- jzelinskie 6y agoRevocation is done in the ShareWith app or API. The ShareWith OIDC service does not handle the refresh tokens; those get handled by your upstream SSO. It's entirely up to whatever application is consuming our OIDC to decide how to set cookies that would make the session short or long lived. In the case of OAuth2Proxy, the default cookie lasts 5 minutes.