10

In Magento [2.2.4] web API when I pass username and password then it generates token for that specific customer (Which is only valid for 1 hour - it is configurable from Magento admin)

http://magento.host/index.php/rest/V1/integration/customer/[email protected]&password=test@123

which returns token.

After generating token, when we pass that token in header.

Authorization :: Bearer *Token Value*

http://magento.host/index.php/rest/V1/customers/me

Which returns customer details.

The above case I explained is working fine for webAPI in magento2 which I tested in POSTMAN.

Now the case is,

Every hour regeneration of token and after that login again every hour is not logical for Mobile Application.

Then how Magento manages user login data and authentication in Mobile application, if it is developed API As per Service Contracts

  • How long should I allow my access tokens to exist before it expires in Mobile Application?
    • I don’t want to force my users to re-authenticate every hour in Mobile Application.
    • How to properly manage your OAuth2 API token life-cycle for Mobile Application.

Making changes in Access Token Lifetime hours would not be logical solution, Because Application and web should have different lifetime hours of Token

enter image description here

Improve this question
9
  • Have you tried to extend token lifetime from store->configuration->services->OAuth->Customer Token Lifetime (Hours) - ?
    – Manthan Dave
    May 11, 2018 at 11:47
  • No, checking it by making a blank value of Customer Token Lifetime (Hours)- which will disable the feature if the value is empty. So might work.
    – Aditya Shah
    May 11, 2018 at 12:06
  • It won't because when we empty the value of Customer Token Lifetime then it will regenerate token every request and that all data will not expire (every request data) and it will stored in oauth_token
    – Aditya Shah
    May 12, 2018 at 4:29
  • If you have access to the code of a store you are connecting or you can write a magento module for your app, one solution would be to update token valid date at each request when customer token is used, similar as session is done. Then until your app does any requests within token lifetime customer won't be forced to re-authorize.
    – Zefiryn
    Jun 15, 2018 at 20:38
  • but based on which flag we consider that customer token is used.
    – Aditya Shah
    Jun 20, 2018 at 5:26

1 Answer 1

Reset to default
4

To check for a valid customer token Magento checks two criteria

  1. Is token revoked ( That happens when user logout) : revoked is saved as 1 in oauth_token table
  2. Token is actually present in oauth_token table

Magento runs a cron to remove the expired tokens (as per lifetime in admin setting) from the table (vendor\magento\module-integration\Cron\CleanExpiredTokens.php)

Possible solution

  1. Increase Token lifetime from admin
  2. Override the above mentioned cron to only remove the token that are revoked i.e the logged out customer tokens

Hope this answers your question

Improve this answer
4
  • I feel you are talking about the user roles ? like admin ... also please accept the answer
    – Vishwas Bhatnagar
    May 14, 2018 at 5:06
  • No, i am talking about M2 authentication used in mobile application in back-end , Because every hour regeneration of token and after that login again every hour is not logical for Mobile Application. It should only be authenticate once and when user change the password (activity like that)
    – Aditya Shah
    May 14, 2018 at 5:19
  • i think i have suggested a solution for that in my above answer we are using the same solution and working flawlessly for us
    – Vishwas Bhatnagar
    May 14, 2018 at 5:22
  • 1
    Thanks man!! I searched a lot but didn't found any solution except yours :)
    – Aditya Shah
    Aug 14, 2018 at 5:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.