Code of Conduct
What article on docs.github.com is affected?
Authenticating to the REST API with an OAuth app
def authenticated?
session[:access_token]
end
What changes are you suggesting?
Change that line to check for refresh_token instead. In production environments, likely in a language other than Ruby, these tokens would be expiring cookies, and the checks for them would be server-side to avoid exposing the cookies to JavaScript code; however, the logic could be easily adapted if not for one mistake in it: the access token would expire before the refresh token, and discarding the user's authentication due to the access token being missing would discard their authentication in less than a day. If that line of code is changed to refresh_token, the rest of the code will play out the same: if the user has a valid access token, it won't be refreshed; if it's missing or invalid, it will.
Additional information
No response
Code of Conduct
What article on docs.github.com is affected?
Authenticating to the REST API with an OAuth app
What changes are you suggesting?
Change that line to check for
refresh_tokeninstead. In production environments, likely in a language other than Ruby, these tokens would be expiring cookies, and the checks for them would be server-side to avoid exposing the cookies to JavaScript code; however, the logic could be easily adapted if not for one mistake in it: the access token would expire before the refresh token, and discarding the user's authentication due to the access token being missing would discard their authentication in less than a day. If that line of code is changed torefresh_token, the rest of the code will play out the same: if the user has a valid access token, it won't be refreshed; if it's missing or invalid, it will.Additional information
No response