MIME-Version: 1.0
From: Ajit Awekar <ajitpostgres@gmail.com>
Date: Mon, 16 Feb 2026 14:40:36 +0530
Message-ID: <CAER375PhG5an=p1=6QS6vWi=BHxR+ViJmYPDkkEtpgVsfCcu_w@mail.gmail.com>
Subject: [OAuth2] Infrastructure for tracking token expiry time
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Content-Type: multipart/mixed; boundary="000000000000a0d028064aed5422"
Archived-At: <https://www.postgresql.org/message-id/CAER375PhG5an%3Dp1%3D6QS6vWi%3DBHxR%2BViJmYPDkkEtpgVsfCcu_w%40mail.gmail.com>
Precedence: bulk

--000000000000a0d028064aed5422
Content-Type: multipart/alternative; boundary="000000000000a0d025064aed5420"

--000000000000a0d025064aed5420
Content-Type: text/plain; charset="UTF-8"

Hi Hackers,

Currently, during OAuth2 authentication,  the ValidatorModuleResult
structure allows a validator(extension) to return the authentication status
and the authn_id.
However, we ignore the token expiry time (exp claim).

Once a token is validated, the backend has no record of when that token
actually expires. A session can remain open indefinitely even if the
underlying access token has expired shortly after the connection was
established.

This patch adds the infrastructure to capture and store this expiration
timestamp within the backend session state. It does not implement an
enforcement policy (such as auto-termination).

Request a review.

Thanks & Best Regards,
Ajit

--000000000000a0d025064aed5420
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Hackers,<br><br>Currently, during OAuth2 authentication=
, =C2=A0the ValidatorModuleResult structure allows a validator(extension) t=
o return the authentication status and the authn_id.<br>However, we ignore =
the token expiry time (exp claim).<div><br>Once a token is validated, the b=
ackend has no record of when that token actually expires. A session can rem=
ain open indefinitely even if the underlying access token has expired short=
ly after the connection was established.<br><br>This patch adds the infrast=
ructure to capture and store this expiration timestamp within the backend s=
ession state. It does not implement an enforcement policy (such as auto-ter=
mination).<br><br>Request a review.<br><br>Thanks &amp; Best Regards,<br>Aj=
it<br><br><br></div></div>

--000000000000a0d025064aed5420--
--000000000000a0d028064aed5422
Content-Type: application/octet-stream; name="password_expiry_oauth.diff"
Content-Disposition: attachment; filename="password_expiry_oauth.diff"
Content-Transfer-Encoding: base64
Content-ID: <f_mloy24x40>
X-Attachment-Id: f_mloy24x40

ZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL2xpYnBxL2F1dGgtb2F1dGguYyBiL3NyYy9iYWNrZW5k
L2xpYnBxL2F1dGgtb2F1dGguYwppbmRleCAxMTM2NTA0ODk1MS4uZWVmMjM4NDE3ZTcgMTAwNjQ0
Ci0tLSBhL3NyYy9iYWNrZW5kL2xpYnBxL2F1dGgtb2F1dGguYworKysgYi9zcmMvYmFja2VuZC9s
aWJwcS9hdXRoLW9hdXRoLmMKQEAgLTY4NCw2ICs2ODQsMTMgQEAgdmFsaWRhdGUoUG9ydCAqcG9y
dCwgY29uc3QgY2hhciAqYXV0aCkKIAkJZ290byBjbGVhbnVwOwogCX0KIAorCS8qCisJICogU3Rv
cmUgdGhlIHRva2VuIGV4cGlyYXRpb24gdGltZSBpbiB0aGUgUG9ydCBzdHJ1Y3R1cmUuIFRoaXMg
YWxsb3dzCisJICogdGhlIGJhY2tlbmQgdG8gZW5mb3JjZSBzZXNzaW9uIGxpbWl0cy4KKwkgKi8K
KwlpZiAocmV0LT5leHBpcnkgPiAwKQorCQlwb3J0LT5leHBpcnkgPSByZXQtPmV4cGlyeTsKKwog
CWlmIChwb3J0LT5oYmEtPm9hdXRoX3NraXBfdXNlcm1hcCkKIAl7CiAJCS8qCmRpZmYgLS1naXQg
YS9zcmMvaW5jbHVkZS9saWJwcS9saWJwcS1iZS5oIGIvc3JjL2luY2x1ZGUvbGlicHEvbGlicHEt
YmUuaAppbmRleCA5MjFiMmRhYTRmZi4uOWJjOTYyNWQwYmEgMTAwNjQ0Ci0tLSBhL3NyYy9pbmNs
dWRlL2xpYnBxL2xpYnBxLWJlLmgKKysrIGIvc3JjL2luY2x1ZGUvbGlicHEvbGlicHEtYmUuaApA
QCAtMjM4LDYgKzIzOCwxNCBAQCB0eXBlZGVmIHN0cnVjdCBQb3J0CiAJY2hhcgkgICAqcmF3X2J1
ZjsKIAlzc2l6ZV90CQlyYXdfYnVmX2NvbnN1bWVkLAogCQkJCXJhd19idWZfcmVtYWluaW5nOwor
CisJLyoKKwkgKiBUaGUgZXhwaXJhdGlvbiB0aW1lIG9mIHRoZSBhdXRoZW50aWNhdGlvbiBjcmVk
ZW50aWFsLiBJZiBub24temVybywgaXQKKwkgKiByZXByZXNlbnRzIHRoZSBwb2ludCBpbiB0aW1l
IGFmdGVyIHdoaWNoIHRoZSBjdXJyZW50IHNlc3Npb24gaXMgY29uc2lkZXJlZAorCSAqIGludmFs
aWQuCisJICovCisJVGltZXN0YW1wVHogZXhwaXJ5OworCiB9IFBvcnQ7CiAKIC8qCmRpZmYgLS1n
aXQgYS9zcmMvaW5jbHVkZS9saWJwcS9vYXV0aC5oIGIvc3JjL2luY2x1ZGUvbGlicHEvb2F1dGgu
aAppbmRleCA0YTgyMmU5YTFmMi4uZTdlMzYwZDk0MTYgMTAwNjQ0Ci0tLSBhL3NyYy9pbmNsdWRl
L2xpYnBxL29hdXRoLmgKKysrIGIvc3JjL2luY2x1ZGUvbGlicHEvb2F1dGguaApAQCAtNDksNiAr
NDksMTIgQEAgdHlwZWRlZiBzdHJ1Y3QgVmFsaWRhdG9yTW9kdWxlUmVzdWx0CiAJICogZGVsZWdh
dGlvbi4gU2VlIHRoZSB2YWxpZGF0b3IgbW9kdWxlIGRvY3VtZW50YXRpb24gZm9yIGRldGFpbHMu
CiAJICovCiAJY2hhcgkgICAqYXV0aG5faWQ7CisKKwkvKgorCSAqIFRoZSBleHBpcmF0aW9uIHRp
bWUgb2YgdGhlIHRva2VuIChlLmcuLCBmcm9tIHRoZSAnZXhwJyBjbGFpbSkuCisJICogSWYgcHJv
dmlkZWQsIHRoZSBiYWNrZW5kIGNhbiB1c2UgdGhpcyB0byBsaW1pdCBzZXNzaW9uIGR1cmF0aW9u
LgorCSAqLworCVRpbWVzdGFtcFR6IGV4cGlyeTsKIH0gVmFsaWRhdG9yTW9kdWxlUmVzdWx0Owog
CiAvKgo=
--000000000000a0d028064aed5422--