Search code examples
c#.net-coreidentityserver4

Can we set access token to not expire?


We are using Identity Server4, the default time is access token expire is 3600 seconds. Can we set it to not expire?

public static IEnumerable<Client> GetClients()
    {
        return new List<Client>
         {
         new Client
        {
        ClientId = "client",

        // no interactive user, use the clientid/secret for authentication
            AllowedGrantTypes = GrantTypes.ClientCredentials,

        // secret for authentication
            ClientSecrets =
            {
            new Secret("secret".Sha256())
            },

        // scopes that client has access to
            AllowedScopes = { "api1" },
            AccessTokenLifetime=3600
    }
};

Solution

  • Technically speaking AccessTokenLifetime is declared as an int so you could do

    AccessTokenLifetime = Int32.MaxValue;
    

    But that's really not going to be a good idea. Once the access token is created its going to continue to work I dont think you expiring it in the backed is going to work as you would like.

    For the fun of it

    TimeSpan t = TimeSpan.FromSeconds(Int32.MaxValue);
    Console.WriteLine(t.Days);
    

    results in a very ugly 24855 days or 68 years.