[OAuthSettings]
Available before Exponential 6: the legacy kernel had it before Exponential 6; the 4.x reference had no page for it.
Summary
The group [OAuthSettings] of settings/rest.ini.
File
settings/rest.ini; override it in settings/override/rest.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| TokenTTL | 3600 | OAuth token/authcode time to live, in seconds Default is one hour |
| RefreshTokenTTL | 2592000 | Refresh token time to live, in seconds; 0 = refresh tokens do not expire (as in earlier versions). Default is 30 days. Every refresh issues a new refresh token, so the lifetime counts from the last refresh. The issue time is derived from the access token's expiry and TokenTTL: changing TokenTTL shifts the deadline of refresh tokens issued before by the difference. |
| AllowTokenInQuery | disabled | Where an access token is taken from. The Authorization header ("Bearer <token>" or "OAuth <token>") is always read and is the recommended way. AllowTokenInQuery: enabled or disabled (the default). Enabled: the oauth_token query parameter (?oauth_token=...) is accepted as well, as in earlier versions. A token in the address ends up in access logs, the browser history and Referer headers (RFC 6750, section 2.3); enable it only for old clients that cannot send the header. |
| AllowTokenInBody | enabled | AllowTokenInBody: enabled (the default) or disabled. Enabled: the oauth_token parameter of a POST form body is accepted when there is no Authorization header (RFC 6750, section 2.2). |
| AuthorizeRequiresPolicy | enabled | enabled or disabled. Enabled (the default): a signed in user may authorize an OAuth client at oauth/authorize only with the policy oauth/authorize (optionally limited by siteaccess); without it the client gets error=access_denied. disabled: every signed in user may authorize clients, as before 6.0.15. Use it only for a short time during an upgrade, until "php bin/php/addoauthauthorizepolicy.php --apply" has granted the policy (doc/eng-us/bc/6.0/oauth-authorize-policy.md). |
| RequirePkceForPublicClients | enabled | PKCE (RFC 7636) for the authorization code flow. A client sends code_challenge and code_challenge_method to oauth/authorize and the matching code_verifier to the token end point (/api/oauth/token); the code is refused there without it. doc/eng-us/bc/6.0/oauth-pkce.md enabled (the default) or disabled. Enabled: a public client (one stored without a client secret, such as a mobile or browser application) must use PKCE; oauth/authorize answers error=invalid_request without a code_challenge. A public client authenticates with its client_id alone, so without PKCE anyone who sees its code can redeem it. |
| RequirePkceForConfidentialClients | disabled | enabled or disabled (the default). Enabled: every client must use PKCE, also one with a client secret. |
| AllowPlainPkce | disabled | enabled or disabled (the default). The challenge method "plain" sends the verifier itself and protects nothing against an attacker who can read the authorization request; only S256 is accepted unless this is enabled. |
See also
Generated example: rest.ini [OAuthSettings]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/rest.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment