socialcast/devise_oauth2_providable — Issue #29: Tokens not expired correctly in production environment
Author: chrisa
Created: 2012-02-01 11:16:39+00:00
State: open

I've noticed that in the production environment, or specifically, with "config.cache_classes = true" set, tokens are not expired properly. I've tested this with Rails 3.1.3 and devise_oauth2_providable 1.0.5.

This seems to be a problem in Devise::Oauth2Providable::ExpirableToken#expires_according_to, where the use of a named scope with a lambda that's then applied using default_scope causes the lambda to be evaulated only once, at server start. That then means that tokens are checked for expiry against the server start time, not against the current time, which means they'll never expire - at least until the server is restarted.

The simplest fix appears to be to pass the lambda directly to default_scope, which does then cause it to be re-evaluated for each load. I couldn't find anywhere that appears to depend on the existence of the named scope itself.