Commit 36768696 authored by Vincent Pelletier's avatar Vincent Pelletier

erp5_oauth2_authorisation: Do not edit OAuth2 Session on every refresh token issuance

Malevolent users may decide to only - and repeatedly - present an otherwise
valid refresh token, causing the issuance of a new access tokens everytime,
likely along with new refresh tokens, causing many ZODB writes.
Avoid this by pushing the token expiration date by one lifespan accuracy,
so there can only be one write per session per lifespan accuracy period.
parent d7c0baf1
Pipeline #37933 failed with stage
in 0 seconds