thenatog commented on a change in pull request #4988:
URL: https://github.com/apache/nifi/pull/4988#discussion_r611885082
##########
File path:
nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/AccessResource.java
##########
@@ -143,6 +146,7 @@
private static final Pattern REVOKE_ACCESS_TOKEN_LOGOUT_FORMAT =
Pattern.compile("(\\.google\\.com)");
private static final Pattern ID_TOKEN_LOGOUT_FORMAT =
Pattern.compile("(\\.okta)");
private static final int msTimeout = 30_000;
+ private static final int TWELVE_HOURS = 43200;
Review comment:
Yeah I think as long as we can keep our JWT expiry to 12 hours (which I
believe is what has been historically used for NiFi/the default for providers)
we can do a session cookie value here. That way the JWT still only has a
expiry/lifetime of 12 hours (or whatever is configured), but if the user closes
the browser without logging out, a malicious user cannot simply open the
browser again to continue using NiFi.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
