Repository navigation
Credential protocol enhancement: OAuth token expiration and refresh tokens #2059
Description
Starting in Git 2.40, the protocol learned a few new keys including around storing and retrieving an OAuth token's expiration date. This will be helpful to support such that tokens stored in credential stores can be used or discarded without an extra network call to determine if they are still within the validity period.
Likewise, the protocol from v2.41 now includes an optional OAuth refresh token key that allows helpers to more easily communicate both an access and refresh token as part of a get + store/erase request and response pair. Today, host providers have had to preemptively store the refresh token manually, in a separate credential store entry, even if the incorrect user account was selected.
Author: @mjcheetham
Activity
crablab commentedon Oct 4, 2025
It's probably worth nothing the lack of support here does lead to problems with Forgjeo instances: https://codeberg.org/forgejo/forgejo/issues/2809
becm commentedon Oct 11, 2025
@crablab just making the data available will not help without further code.
To have notable effect, using a multi-step auth schema (#2057) would be needed (and triggered) on expired items.
Expiry check (#268) with internal refresh (#1837) is a more
primitivecontained solution to this issue. ☺becm commentedon Oct 11, 2025
@dscho putting the
refresh_tokenon the wire may have security drawbacks:access_tokenrefresh_token"for free"If I'd have to choose; better to (proactively) refresh the requested
access_tokeninternally on detected expiry.(And maybe even think of ways to better secure the
refresh_tokenas a private GCM secret).mr-otmarg commentedon Nov 6, 2025
Similar topic #2003