Re: GraphQL API security review 4 months ago

From David Hagerty to ~sircmpwn/sr.ht-dev

On Tue Sep 15, 2020 at 11:19 AM EDT, Drew DeVault wrote:
> Expiry is a Unix timestamp set 1 year in the future from token issuance.

If no one else has qualms about that expiry length on tokens, I
understand, but I personally get a little nervous with long-lived tokens
like this. If a token becomes compromised, that's a much longer span of
time where it can be used maliciously.

When I've developed APIs for my employer, the advice has been
to go for shorter expiries, on the order of a month.