1

We want to understand what's the expiry time of a JWT token obtained via sfdx force:auth:jwt:grant so we use the OpenID connect introspection endpoint /services/oauth2/introspect

The response is correct according to the standard https://www.rfc-editor.org/rfc/rfc7662#section-2.1 but the iat (issued at) always correspond to the time we are invoking the endpoint (and not when the access token was issued!) and the expiry time is always "1 hour from now"

Why is this behaviour occurring?

1 Answer 1

1

We were able to repro this without sfdx using a vanilla password grant type. Introspecting the issued token repeatedly with some time interval between attempts shows that values of iat (issued at), nbf (not before) and exp (expiration) eventually do change. iat and nbf shouldn't change, that's a bug or two.

exp changing is likely a bug as well. Session timeout could affect token expiration in some scenarios:

The last active session time value isn’t updated until halfway through the timeout period. So if you have a 30-minute timeout, the system checks for activity when 15 minutes have passed. If you update a record after 20 minutes, your timeout resets because it’s 5 minutes after the active session time is checked. In that scenario, you have another 30 minutes before logout occurs, for a total of 50 minutes. But if you update a record after 10 minutes, logout occurs 20 minutes later (30 minutes total) because there was no activity in the past 15 minutes.

In our repro sequence, the time interval between attempts was less than 1/2 of the timeout period so exp shouldn't have moved. The doc note above is confusingly worded so SF could claim that exp is changing because you touch the session via the Introspection endpoint. If so, the bug would be counting introspection of the token as an activity that extends the expiry.

Perhaps the underlying token is still correct but Introspect is reporting bogus timestamps. Either way, please open a support case with SF and let them know.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .