#wordpress 2021-06-15

2021-06-15 UTC
[Will_Monroe] joined the channel
#
[Will_Monroe] [dshanske] That didn't seem to work. Here's what I did:
#
[Will_Monroe] 3. Saved token to Indigenous for Desktop Settings > The token for both endpoints (see screenshot)
#
[Will_Monroe] 1. In WP, went to Users > Manage Tokens > Add New Token
#
[Will_Monroe] 2. Named token, Added Token and copied the token
#
[Will_Monroe] 4. Added settings for Post endpoint, Media endpoint as listed in Indigenous for Android (which is working)
#
[Will_Monroe] 5. Added setting for Reader endpoint as listed in Indigenous for Android
#
[Will_Monroe] The settings for the Post and Media endpoints both point to my domain. But the setting for the reader points to Aperture.
#
[Will_Monroe] Can you see any obvious errors I might have made?
#
GWG No, but what is the error?
#
[Will_Monroe] "Something went wrong loading the channels"
#
[Will_Monroe] Actually, both the Post and Media endpoints seem to work! Only the Reader endpoint seems to be having trouble.
#
[Will_Monroe] [dshanske] I think I may have the answer: See Token generation in Wordpress https://github.com/swentel/indigenous-desktop
#
[Will_Monroe] I should have noticed this earlier
[tw2113_Slack_] joined the channel
#
Loqi [swentel] indigenous-desktop: An IndieWeb Desktop app with extensions for sharing information to micropub endpoints and reading from microsub endpoints
Ruxton, [schmarty], [jacky], [Murray], [chee], tonz, [KevinMarks] and [pfefferle] joined the channel
#
[pfefferle] GWG I just had a look at your PR… does the renew, simply update the timestamp on the token?
#
GWG [pfefferle]: The expiration timestamp yes
#
GWG The cron job expires the token or the attempt to use an expired token
#
[pfefferle] hmmm, shouldn’t this be an oauth renewal process? https://www.oauth.com/oauth2-servers/access-tokens/refreshing-access-tokens/
#
GWG It could be in a future pr, but no IndieAuth client supports refresh yet
#
[pfefferle] or why do you have implemented the expired feature?
#
GWG So that tokens don't last forever
#
[pfefferle] does the expires update after a “new” login?
#
GWG No
#
GWG Tokens are valid for 14 days unless you extend them
#
GWG Or disable expiry
#
[pfefferle] that means, that a client that has access to my blog will no longer work if I do not update the token?
#
GWG Yes
#
[pfefferle] does that make sense?
#
[pfefferle] I think you added it because of security reasons?
#
GWG Yes
#
GWG https://github.com/indieweb/wordpress-indieauth/issues/171
#
GWG Also I wasn't the only requestor
#
GWG The other option is to put the setting on the consent screen
#
Loqi [janboddez] #171 Token expiration filter?
#
[pfefferle] but shouldn’t we use something like “if a token was not used for more than 15 days, delete it”?
#
GWG That is also an option
#
GWG I was looking at what other implementations did
#
[pfefferle] that wouldn’t delete “active” tokens
#
GWG gRegor and jamietanna, for example, both set expiring tokens
#
[pfefferle] therefore we have to update the expires date every time a token is used
#
GWG [pfefferle]: Actually no
jeremycherfas joined the channel
#
GWG The feature you are suggesting is there in the last accessed field
#
GWG It's a little different
#
GWG [pfefferle]: There is a compromise position
#
GWG I can add the option to disable expiry and people can choose
#
[pfefferle] hmmm, but I like the feature in general, but I do fear that an active token might be expire
#
GWG Essentially, let expiration be set to 0 to disable
#
[pfefferle] I do not want to disable it in general
#
[pfefferle] I like the idea of deleting unused tokens
#
[pfefferle] I am just thinking about a way to identify “inactive”/“unused” tokens
#
GWG I see that as a different feature
#
[pfefferle] ok, maybe
#
GWG That's a good feature though
#
GWG Expiring tokens are set at time of creation, they don't necessarily have to correspond with refresh... though I am happy to build refresh tokens as a feature
#
GWG https://www.jvt.me/posts/2021/01/31/refresh-token-indieauth/
#
GWG At least one person did
#
[pfefferle] that is not what I meant
#
GWG I know.. just exploring options
#
Loqi [Jamie Tanna] Implementing the Refresh Token Grant in my IndieAuth Server
#
[pfefferle] I only had the idea to update the “expires in”, if a token was used
#
[pfefferle] to keep it alive
#
GWG Okay
#
GWG I see that as a different feature, which I would add
#
GWG So, what do you think in the end re this?
#
[pfefferle] I understand the reason behind but it. What is the default behaviour atm.?
#
[pfefferle] expires on or off?
#
GWG [pfefferle]: Expires on at 14 days
#
GWG But I could change the default and let people choose to turn it on
#
GWG Or let them turn it off, which I didn't build
#
[pfefferle] shouldn’t off be the default, to not change the behaviour for existing users?
#
[pfefferle] opt-in
#
GWG [pfefferle]: I am happy to change the default to disabled
#
[pfefferle] just thinking
#
GWG If everything else is satisfactory, I can commit that as a change
#
[pfefferle] I added some comments to your PR
#
[pfefferle] I am also fine with default on, but would recommend to raise a major version then, because it is a breaking change
#
GWG Okay. Will examine it next work break
jeremycherfas, Tomte, jeremych-, [jacky], [KevinMarks], bode, [chrisaldrich], [tw2113_Slack_] and [asuh] joined the channel