Access Token life time

[WvdAkker]

Hi,

I am lost ...
Thought the access token lifetime is 2 hours (AUTH_HASH_TTL = 2hrs in the option list).

However, last evening at 19:52 I created an access token. It shows it should expire at 21:52.
With the token I added a life stream om my website expecting this would stop at 21:52.
The stream continues after 21:52. Also stopping starting webbrowser did not had any effect.
The stream continues to show with the old (expired ?) token.

I use <img src="https://server/zm/cgi-bin/nph-zms?scale ... ken=<token>" />
for the stream.

After 13 hours I can still access the camera with the old access token.

Do I miss something about the lifetime of the access token?

[iconnor]

the zms streaming cgi won't constantly check the validity of the token. Only at the start of the request. So once a stream starts it will go forever.

Perhaps we should fix that.

[WvdAkker]

Ah ok.
What is considered start of the stream?

'Endless time' for an access token is for a website the easiest to maintain.
However from security point of view it is not desirable, I guess and the
zms streaming cgi should check if the token is not expired.

I will create an issue for it and see if it make sense.