paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 40 Packages Projects Releases Wiki Activity

Merge pull request #34142 from backstage/session/suspicious-heron-9w2p

Browse Source 
feat(auth-backend): validate catalog user existence on refresh token usage
This commit is contained in:
Patrik Oldsberg
2026-05-18 11:17:21 +02:00
committed by GitHub
parent eab8f7a510 ed4ffaa3b3
commit 735af6c8c0
5 changed files with 225 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/validate-catalog-user-on-refresh.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/plugin-auth-backend': patch
---
Refresh token usage now verifies that the user's catalog entity still exists before issuing a new access token. If the user has been removed from the catalog, the refresh is rejected and the session is revoked. Transient catalog errors reject the refresh but preserve the session for retry. This check can be disabled by setting `auth.experimentalRefreshToken.dangerouslyDisableCatalogPresenceCheck` to `true`.