Client Authentication: Shorter TTL requires more frequent logins

[jstlaurent]

Context

The Hub-issued JSON Web Tokens contain a list of a user membership's in organizations. However, this list is established when the token is issued, and will be used to determine authorization for API access. If a user's membership changes before the token is renewed, it will become stale.

We have reduced the time to live of our tokens to shorten the staleness delay, but this seems to require the user to login more frequently. This is undesirable user experience.

Description

Investigate a better flow where the Hub-issued token is refreshed by getting a new JWT in exchange for the underlying, Clerk-issued token. The ensure_active_token method in the PolarisHubClient has such a mechanism.

Acceptance Criteria

• The number of times a user is required to manually login is reduced

Links

• Polaris Client Authentication Design Document