github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

max_signed_tokens_ttl setting, closes #1858

Browse source 
Also redesigned token format to include creation time and optional duration.
This commit is contained in:
Simon Willison 2022-10-26 14:13:31 -07:00
commit 382a871583
6 changed files with 99 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/settings.rst
View file

@ -182,6 +182,21 @@ This is turned on by default. Use the following to turn it off::
Turning this setting off will disable the ``/-/create-token`` page, :ref:`described here <CreateTokenView>`. It will also cause any incoming ``Authorization: Bearer dstok_...`` API tokens to be ignored.
.. _setting_max_signed_tokens_ttl:
max_signed_tokens_ttl
~~~~~~~~~~~~~~~~~~~~~
Maximum allowed expiry time for signed API tokens created by users.
Defaults to ``0`` which means no limit - tokens can be created that will never expire.
Set this to a value in seconds to limit the maximum expiry time. For example, to set that limit to 24 hours you would use::
datasette mydatabase.db --setting max_signed_tokens_ttl 86400
This setting is enforced when incoming tokens are processed.
.. _setting_default_cache_ttl:
default_cache_ttl