{"action":"created","issue":{"url":"https://api.github.com/repos/guardian/play-googleauth/issues/56","repository_url":"https://api.github.com/repos/guardian/play-googleauth","labels_url":"https://api.github.com/repos/guardian/play-googleauth/issues/56/labels{/name}","comments_url":"https://api.github.com/repos/guardian/play-googleauth/issues/56/comments","events_url":"https://api.github.com/repos/guardian/play-googleauth/issues/56/events","html_url":"https://github.com/guardian/play-googleauth/pull/56","id":297768818,"number":56,"title":"Send users with expired JWT tokens back to the start of the OAuth flow","user":{"login":"rtyley","id":52038,"avatar_url":"https://avatars3.githubusercontent.com/u/52038?v=4","gravatar_id":"","url":"https://api.github.com/users/rtyley","html_url":"https://github.com/rtyley","followers_url":"https://api.github.com/users/rtyley/followers","following_url":"https://api.github.com/users/rtyley/following{/other_user}","gists_url":"https://api.github.com/users/rtyley/gists{/gist_id}","starred_url":"https://api.github.com/users/rtyley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rtyley/subscriptions","organizations_url":"https://api.github.com/users/rtyley/orgs","repos_url":"https://api.github.com/users/rtyley/repos","events_url":"https://api.github.com/users/rtyley/events{/privacy}","received_events_url":"https://api.github.com/users/rtyley/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-16T12:25:18Z","updated_at":"2018-02-20T10:27:08Z","closed_at":"2018-02-16T14:57:40Z","author_association":"OWNER","pull_request":{"url":"https://api.github.com/repos/guardian/play-googleauth/pulls/56","html_url":"https://github.com/guardian/play-googleauth/pull/56","diff_url":"https://github.com/guardian/play-googleauth/pull/56.diff","patch_url":"https://github.com/guardian/play-googleauth/pull/56.patch"},"body":"This PR follows on from https://github.com/guardian/play-googleauth/pull/52 which introduced JWT signing of the anti-forgery token (with an aggressive timeout of 60 seconds - we arbitrarily chose that timeout as an expiration time to guard against malicious re-use).\r\n\r\nIf a user was sent off to the Google auth flow, but took longer than 60 seconds to complete that flow (maybe they were asked a password, or just asked to select from multiple Google accounts that they possessed), their JWT anti-forgery token would have expired, and the user would receive an unfriendly \"JWT Expired\" message:\r\n\r\n![image](https://user-images.githubusercontent.com/52038/36307490-5744f6f2-1314-11e8-900f-64b8b5b4b98c.png)\r\n\r\nThis change means that instead of seeing that message, they will instead be taken directly back to Google to re-authenticate (if they were asked their password before, it's likely Google won't ask them again, and the process will be invisible). This seems like a slightly better fix than just increasing the timeout of the JWT token - sometimes Ophan users with multiple tabs will go for nearly an hour before looking at the tab with a half-completed authentication flow, so we would have had to set the expiration timeout at least that high.\r\n\r\nI've also tweaked the logging to make it easier for me to see what remaining issues our users in Australia are seeing...\r\n\r\ncc @katebee "},"comment":{"url":"https://api.github.com/repos/guardian/play-googleauth/issues/comments/366933768","html_url":"https://github.com/guardian/play-googleauth/pull/56#issuecomment-366933768","issue_url":"https://api.github.com/repos/guardian/play-googleauth/issues/56","id":366933768,"user":{"login":"rtyley","id":52038,"avatar_url":"https://avatars3.githubusercontent.com/u/52038?v=4","gravatar_id":"","url":"https://api.github.com/users/rtyley","html_url":"https://github.com/rtyley","followers_url":"https://api.github.com/users/rtyley/followers","following_url":"https://api.github.com/users/rtyley/following{/other_user}","gists_url":"https://api.github.com/users/rtyley/gists{/gist_id}","starred_url":"https://api.github.com/users/rtyley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rtyley/subscriptions","organizations_url":"https://api.github.com/users/rtyley/orgs","repos_url":"https://api.github.com/users/rtyley/repos","events_url":"https://api.github.com/users/rtyley/events{/privacy}","received_events_url":"https://api.github.com/users/rtyley/received_events","type":"User","site_admin":false},"created_at":"2018-02-20T10:27:07Z","updated_at":"2018-02-20T10:27:07Z","author_association":"OWNER","body":"Looking at the logs in Cloudwatch Logs:\r\n\r\n```\r\nawslogs get ophan-dashboard-PROD ALL --start='2018-02-16T16:00' --filter-pattern=\"\\\"failed-oauth-callback\\\"\" --profile ophan --aws-region eu-west-1 > ~/failed-oauth-callback.log\r\n```"}}
{"actor":{"display_login":"rtyley"}}