Commit 8db1f256 authored by Vincent Pelletier's avatar Vincent Pelletier Committed by Titouan Soulard

erp5_oauth2_authorisation: Do not edit OAuth2 Session on every refresh token issuance

Malevolent users may decide to only - and repeatedly - present an otherwise
valid refresh token, causing the issuance of a new access tokens everytime,
likely along with new refresh tokens, causing many ZODB writes.
Avoid this by pushing the token expiration date by one lifespan accuracy,
so there can only be one write per session per lifespan accuracy period.
parent a4b2bc3b
Pipeline #37950 passed with stage
in 0 seconds