Delete expired tokens from database

[shvechikov]

I don't see any purging mechanism for expired tokens.
I think it's worth to have a management command to delete expired tokens.
Am I missing something here?

[synasius]

+1
Yes it would be great! We'd love to review a PR on that ;)

[alewisohn]

I was looking for something like this as well, but I'm curious as to how this would work. If a refresh token exists, and it has a foreign key to an access token, then you cannot delete access tokens and leave the refresh tokens in place. Would the management command then just delete all access tokens, and the corresponding refresh tokens, that are older than a specific timedelta?

[shvechikov]

Good question! It seems that it doesn't make sense to purge old tokens unless refresh token has it's own expiration time.

[alewisohn]

I came up with the following logic for cleaning up tokens. In our app, it runs as a periodic task, but it could easily be converted to a management command.

AccessToken.objects.filter(refresh_token__isnull=True, expires__lt=datetime.now()).delete()

Basically, we can delete any access tokens that have expired and that do not have a corresponding refresh token, i.e., the refresh token for that access token has been used. Unused refresh tokens and their related access tokens will still hang around.

Without and expiration on refresh tokens, there's no way to clean them up without invalidating the related access tokens. A management command could be written that accepts an explicit expiration time for refresh tokens though.

[trbs]

Why not (at least) configure a static REFRESH_TOKEN_EXPIRE_SECONDS which indicated how long we want to keep the access_token + refresh_token pair after the access_token has expired.

The cleanup mechanism could then be:

with transaction.atomic():
    if REFRESH_TOKEN_EXPIRE_SECONDS:
        refresh_expire_date = timezone.now()-timedelta(seconds=REFRESH_TOKEN_EXPIRE_SECONDS)
        RefreshToken.objects.filter(access_token__expires__lt=refresh_expire_date).delete()
    AccessToken.objects.filter(refresh_token__isnull=True, expires__lt=datetime.now()).delete()

Futher steps might be to be able to override the REFRESH_TOKEN_EXPIRE_SECONDS per application. So that one might have unlimited refresh_tokens on some applications (ios/android apps?) and not on others (web api's).

[SilviyaRepo]

Could you tell me elaborately how you achieved this???

[bforchhammer]

We use the oauth toolkit with a quite a large user-base and are getting to a point where the access tokens table is getting quite large; we have >150M tokens with only a small percentage active. I would love to see a way to purge expired ones, without having to delete any refresh tokens.

The cleanup script above (and in the related issue/pull request) looks good, but it only deletes access tokens for which the refresh token has been used already. Could we instead make the relationship between access and refresh token optional and delete all expired access tokens?

[synasius]

Closed by #249