Google cloud: Expiration of Bearer token

user_15092614 0
Viewed 544

I am using a Bearer token to access a website. I am adding this token to Authorization HTTP-header and I can get access to development website. It is necessary for safety. I was surprised, that Bearer token is expiring in 1 hour by default. Is it any way to fix it and change token's lifetime?

UPD: I have already known, that no, it isn't possible. There was some way to up it to 12 hours. I didn't try it, but i would like get better option.

I tried another option: Identity-Aware Proxy — not my option, it works only for GAE or HTTPS Load Balancer. I work with CloudRun without HTTPS Load Balancer.

google-cloud-platform
1 Answers

It's quite an open question as many things depend on various variables. You are using GCP IAM, ApiGee or something else.

In general as guillaume blaquiere mentioned in comments, you can create Service Account which Access Token will be valid for 12 hours. It's well described in the GCP IAM DocCreating short-lived service account credentials - Generating an OAuth 2.0 access token:

By default, OAuth 2.0 access tokens are valid for a maximum of 1 hour (3,600 seconds). However, you can extend the maximum lifetime for these tokens to 12 hours (43,200 seconds).

Due to security reasons, using Non-expiring access tokens is not the best approach. Recommended way is to use access token and refresh token.

GCP also provides a product called ApiGee. In ApiGee documentation, you can find some examples of best practice like Secure an API with OAuth and less secure AntiPatterns, which shows example to use 30 mins access token and refresh token which will be valid for 200 days.

<OAuthV2 name="GenerateAccessToken">
    <Operation>GenerateAccessToken</Operation>
    <ExpiresIn>1800000</ExpiresIn> <!-- 30 minutes -->
    <RefreshTokenExpiresIn>17280000000</RefreshTokenExpiresIn> <!-- 200 days -->
    <SupportedGrantTypes>
      <GrantType>password</GrantType>
    </SupportedGrantTypes>
    <GenerateResponse enabled="true"/>
</OAuthV2>

More details about this method you can find in Requesting access tokens and authorization codes - Authorization documentation.

To sum up.

In GCP you can extend the default validation of access token from 1 hour to 12 hours, not more due to security reasons. Further extension of this time you can achieve by using refresh token.

Useful links:

user_111481390
Related