Extend authorization request and auth flow expiry to 60 minutes by PasinduYeshan · Pull Request #4539 · thunder-id/thunderid

PasinduYeshan · 2026-08-04T06:51:36Z

Purpose

Extend two sign-in lifetimes to 60 minutes, and make the authorization request context validity configurable.

Context	Before	After
OAuth2 authorization request	10 min, hardcoded	60 min, configurable via `oauth.authorization_request.validity_period`
Authentication flow (`authFlow.expirySeconds` / `defaultAuthFlowExpiry`)	30 min	60 min

The authorization request context was the shorter of the two, so a user who took more than 10 minutes over sign-in lost the OAuth context while the flow was still alive, and the callback failed with invalid_request instead of completing.

Approach

Configurable authorization request validity

New oauth.authorization_request.validity_period (seconds), defaulting to 3600 in default.json, alongside the existing oauth.authorization_code.validity_period. Overridable from deployment.yaml like any other OAuth setting.
newAuthorizationRequestStore now takes the configured value, wired in authz/init.go from the oauthconfig.Config already passed to Initialize.
A non-positive value falls back to defaultAuthzRequestValidity (60 minutes), matching how token_revocation.sync_interval_seconds handles the same case.

Auth flow expiry

flowexec/constants.go - defaultAuthFlowExpiry 1800 -> 3600 (the fallback used when no server config supplies a value).
02-server-configurations.yaml - authFlow.expirySeconds 1800 -> 3600 (the bootstrapped server config).

Both layers are updated so the effective value is 60 minutes whether or not the bootstrap config is present. Flow expiry was already configurable through the server-config flow section, so no new setting is needed there.

Only authFlow is changed. registrationFlow is already 3600; recoveryFlow and signOutFlow (1800) and userOnboardingFlow (86400) are out of scope.

Docs in deployment/configuration.mdx gain a row for the new setting, and the flow examples are updated to match the new default.

Related Issues

N/A

Related PRs

N/A

Checklist

Security checks

Followed secure coding standards in WSO2 Secure Coding Guidelines
Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

Improvements
- Authentication flows now remain valid for up to 60 minutes instead of 30 minutes.
- OAuth authorization requests are retained for up to 60 minutes by default.
- OAuth authorization-request validity can now be configured in server settings.
Documentation
- Updated configuration examples and defaults to reflect the 60-minute authentication flow and authorization-request validity periods.

coderabbitai · 2026-08-04T06:54:39Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

The change increases authentication flow expiry to 3600 seconds and adds configurable authorization request validity. Positive values apply as seconds-based durations. Non-positive values use a 60-minute default. Configuration, tests, deployment templates, and documentation are updated.

Changes

Authentication and authorization request expiry

Layer / File(s)	Summary
Configuration schema and deployment wiring `backend/pkg/thunderidengine/config/config.go`, `backend/cmd/server/config/default.json`, `install/helm/...`	Adds authorization request validity configuration and wires the 3600-second default through JSON and Helm deployment settings.
Authorization request validity period implementation `backend/internal/oauth/oauth2/authz/*.go`, `backend/internal/oauth/oauth2/authz/auth_req_store_test.go`	Applies positive configured validity periods. Uses the 60-minute default for zero or negative values. Tests cover both paths.
Authentication flow expiry extension `backend/internal/flow/flowexec/constants.go`, `backend/cmd/server/bootstrap/02-server-configurations.yaml`, `backend/internal/flow/flowexec/service_test.go`	Increases default authentication flow expiry from 1800 to 3600 seconds. Updates related test expectations.
Deployment documentation updates `docs/content/deployment/configuration.mdx`, `install/helm/README.md`	Documents authorization request validity, fallback behavior, Helm values, and 3600-second authentication flow examples.

Estimated code review effort: 2 (Simple) | ~12 minutes

Possibly related PRs

thunder-id/thunderid#4591: Shares flow-execution test coverage and administrative-flow expiry behavior.

Suggested reviewers: thiva-k, rajithacharith

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: extending authorization request and authentication flow expiry to 60 minutes.
Description check	✅ Passed	The description covers the purpose, approach, scope, configuration, documentation, tests, and security checks for the changes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

docs/content/deployment/configuration.mdx

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

ThaminduDilshan · 2026-08-04T10:31:01Z

 	return &authorizationRequestStore{
 		storeProvider:  storeProvider,
-		validityPeriod: 10 * time.Minute,
+		validityPeriod: 60 * time.Minute,


IMO better to give a configuration for this too. Otherwise this again will easily expire when the auth flow expiry time is increased

Introduced a config.

coderabbitai · 2026-08-05T06:40:37Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

PasinduYeshan · 2026-08-05T10:32:21Z

With default:

With

oauth:
  authorization_request:
    validity_period: 120

coderabbitai · 2026-08-05T10:32:57Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

codecov · 2026-08-05T10:53:10Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

ThaminduDilshan · 2026-08-05T10:54:25Z

      "validity_period": 600
    },
+    "authorization_request": {
+      "validity_period": 3600


Need to add this to helm and other deployment templates too

Raise the OAuth2 authorization request context validity from 10 minutes and the authentication flow context expiry from 30 minutes to 60 minutes, so a user who takes longer over sign-in is not dropped mid-flow. Make the authorization request context validity configurable through oauth.authorization_request.validity_period. A non-positive value falls back to the built-in 60 minute default.

coderabbitai · 2026-08-05T11:42:40Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@install/helm/README.md`:
- Line 506: Update the description for
configuration.oauth.authorizationRequest.validityPeriod in the Helm README to
state that zero or negative values fall back to 3600 seconds, while preserving
the existing explanation and default value.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9fb6154a-146e-401c-b083-2d4998724681

📥 Commits

Reviewing files that changed from the base of the PR and between f0262ee and d694e36.

📒 Files selected for processing (13)

backend/cmd/server/bootstrap/02-server-configurations.yaml
backend/cmd/server/config/default.json
backend/internal/flow/flowexec/constants.go
backend/internal/flow/flowexec/service_test.go
backend/internal/oauth/oauth2/authz/auth_req_store.go
backend/internal/oauth/oauth2/authz/auth_req_store_test.go
backend/internal/oauth/oauth2/authz/constants.go
backend/internal/oauth/oauth2/authz/init.go
backend/pkg/thunderidengine/config/config.go
docs/content/deployment/configuration.mdx
install/helm/README.md
install/helm/conf/deployment.yaml
install/helm/values.yaml

🚧 Files skipped from review as they are similar to previous changes (10)

backend/cmd/server/config/default.json
backend/internal/oauth/oauth2/authz/auth_req_store.go
backend/internal/oauth/oauth2/authz/init.go
backend/pkg/thunderidengine/config/config.go
backend/internal/oauth/oauth2/authz/constants.go
backend/cmd/server/bootstrap/02-server-configurations.yaml
backend/internal/oauth/oauth2/authz/auth_req_store_test.go
docs/content/deployment/configuration.mdx
backend/internal/flow/flowexec/constants.go
backend/internal/flow/flowexec/service_test.go

PasinduYeshan requested review from ThaminduDilshan and thiva-k as code owners August 4, 2026 06:51

ThaminduDilshan added the Type/Bug label Aug 4, 2026

ThaminduDilshan reviewed Aug 4, 2026

View reviewed changes

PasinduYeshan force-pushed the improve/extend-authz-context-and-flow-expiry branch 2 times, most recently from 190a430 to 098e056 Compare August 5, 2026 06:40

PasinduYeshan force-pushed the improve/extend-authz-context-and-flow-expiry branch from 098e056 to e7a08c8 Compare August 5, 2026 10:32

PasinduYeshan added the trigger-pr-builder Add when the PR is ready for CI; starts the PR Builder for this and all later pushes label Aug 5, 2026

ThaminduDilshan reviewed Aug 5, 2026

View reviewed changes

PasinduYeshan force-pushed the improve/extend-authz-context-and-flow-expiry branch from e7a08c8 to d694e36 Compare August 5, 2026 11:42

PasinduYeshan requested a review from rajithacharith as a code owner August 5, 2026 11:42

coderabbitai Bot reviewed Aug 5, 2026

View reviewed changes

Comment thread install/helm/README.md

ThaminduDilshan approved these changes Aug 5, 2026

View reviewed changes

ThaminduDilshan added this pull request to the merge queue Aug 5, 2026

Merged via the queue into thunder-id:main with commit 2a9a1c6 Aug 5, 2026
27 checks passed

Uh oh!

Conversation

PasinduYeshan commented Aug 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Approach

Related Issues

Related PRs

Checklist

Security checks

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Uh oh!

ThaminduDilshan Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

PasinduYeshan Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Aug 5, 2026

Uh oh!

PasinduYeshan commented Aug 5, 2026

Uh oh!

coderabbitai Bot commented Aug 5, 2026

Uh oh!

codecov Bot commented Aug 5, 2026

Codecov Report

Uh oh!

ThaminduDilshan Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

PasinduYeshan Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Aug 5, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

PasinduYeshan commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading