Server-2-Server Auth Timeout?

[Michael_Krotsch]

Hi guys!

I have a question about the server to server session, specifically given how you guys handle authentication. I'm currently using lccs.php, but rather than call "login" every time I want to create a room or generate an authentication key, I am stashing the RTCAccount instance in memcache (timeout 24 hours) so I have easy access to it. This all works fine- authenticates only once, room and template creation is great and everything is hunky dory.

Except when I go and do something else for a few hours. As soon as I come back, every auth url that is constructed and queried by RTCAccount or RTCSession comes back as the standard LCCS "Join a room" page. Needless to say, creating a room and all the other fun stuff just fails.

I've made one notable modification to lccs.php, and that is to make the account secret a property of RTCAccount that is then used to construct RTCSession whenever that object is instantiated.

So my question is: How do the authentication guts of your server-to-server api work, and what change can I make to eithe rrefresh the RTCAccount object when necessary and/or prevent the expiry of an S2S session? I've tried changing the cache timeout to 30 minutes, however that didn't work, and I figured before I trial-and-error the "perfect" timeout I figure I might ask you guys first.

Michael

[Raff_]

The authentication token used for the developer account expires after 12-15 minutes of inactivity (I am still trying to figure out what the right number is) so if you are using your account for extended period of times you should "refresh" the token something like every 10 minutes.

Two ways of do this:

1) have something in your application server that every 10 minutes calls "AccountManager.keepAlive" (or any method that you may need to call once in a while). If PHP doesn't allow this you can have a cron job set to call a "ping" method in your application and refresh the token there.

2) keep track of the last time you did a request to the server. If the next request comes less than 10 minute from the previous one you are good. If not you need to authenticate again (just remember that calling Session.getAuthenticationToken doesn't go back to the server so that doesn't count for keeping the authentication token active)

At some point I'll try to implement #2 directly in the current API. Just didn't get a chance to do it yet.