{"push_id":2336447159,"size":2,"distinct_size":1,"ref":"refs/heads/master","head":"508c3d46383f4839a200f1e326742f445fa165fe","before":"43d3f4a159c9969927152fc726a3e6becb24d351","commits":[{"sha":"9a95b2ba75b4ab78759aef1228388f8d1ec6485a","author":{"name":"Roberto Tyley","email":"65b05494b630ef70485c2b4a95a03c6bc275c77b@gmail.com"},"message":"Send users with expired JWT tokens back to the start of the OAuth flow\n\nThis PR follows on from https://github.com/guardian/play-googleauth/pull/52\nwhich introduced JWT signing of the anti-forgery token, with an aggressive\ntimeout of 60 seconds (we arbitrarily chose 60 seconds as an expiration\ntime to guard against malicious re-use).\n\nIf a user was sent off to the Google auth flow, but took longer than\n60 seconds to complete that flow (maybe they were asked a password, or just\nasked to select from multiple Google accounts that they possessed), their\nJWT anti-forgery token would have expired, and the user would receive\nan unfriendly \"JWT Expired\" message.\n\nThis change means that instead of seeing that message, they will instead\nbe taken directly back to Google to re-authenticate (if they were asked\ntheir password before, it's likely Google won't ask them again, and the\nprocess will be invisible).\n\nI've also tweaked the logging to make it easier for me to see what\nremaining issues our users in Australia are seeing...","distinct":false,"url":"https://api.github.com/repos/guardian/play-googleauth/commits/9a95b2ba75b4ab78759aef1228388f8d1ec6485a"},{"sha":"508c3d46383f4839a200f1e326742f445fa165fe","author":{"name":"Roberto Tyley","email":"65b05494b630ef70485c2b4a95a03c6bc275c77b@gmail.com"},"message":"Merge pull request #56 from guardian/reauthenticate-users-with-expired-jwt\n\nSend users with expired JWT tokens back to the start of the OAuth flow","distinct":true,"url":"https://api.github.com/repos/guardian/play-googleauth/commits/508c3d46383f4839a200f1e326742f445fa165fe"}]}
{"actor":{"display_login":"rtyley"}}