GitHub Codespaces token validity after repository permission revocation

Question

GitHub Codespaces utilizes short-lived tokens to provide seamless authentication to the GitHub API, adhering to the principle of least privilege by scoping permissions to the specific repository. These tokens are designed to expire upon session termination or codespace deletion.

There is uncertainty regarding the propagation delay when a user's repository permissions are revoked while a codespace session remains active. It is unclear if the active GITHUB_TOKEN is invalidated immediately upon the permission change or if it remains valid until the token's natural expiration or the session's end.

Does the GITHUB_TOKEN reflect permission changes in real-time?
  What is the expected synchronization lag between identity provider permission updates and the active container's token validity?

Tasadduq Burney · Answer

Answer
The GITHUB_TOKEN inside an active GitHub Codespace does not update instantly when repository permissions are revoked. The token remains usable until it expires, the codespace is stopped/restarted, or GitHub explicitly revokes it.
Likely explanation
Permission changes are enforced for new token issuance, reconnections, and subsequent authorization checks, but an already‑issued bearer token is not pulled from the container in real‑time. Cached or already‑authorized operations may therefore succeed for a short window after the revocation.
Steps to handle revocation

If you can tolerate a brief window of continued access, no action is required beyond waiting for the token to expire or the codespace to end.
  If immediate revocation is needed, stop or delete the codespace from the GitHub UI or via gh codespace stop --codespace NAME (or delete).
  After stopping, start a fresh codespace to obtain a new token that reflects the updated permissions.

Missing diagnostic detail
Do you require immediate token invalidation for your security incident response? If yes, the stop/delete step is essential; otherwise you can rely on the token’s natural expiration.

GitHub Codespaces token validity after repository permission revocation

1 answer

Answer

Likely explanation

Steps to handle revocation

Missing diagnostic detail

Your perspective belongs here.

0 question comments