Goal Determine the exact behavior of Glitch when an OAuth access token reaches its expiration time. Constraints and uncertainty Official documentation describes token issuance and scopes but omits the token lifecycle after expiry. No explicit mention of automatic token refresh or a mandated re‑authentication flow. Community reports suggest a manual re‑login is required, yet no official confirmation exists. Open questions Does Glitch automatically attempt a token refresh using a refresh token, or does it immediately invalidate the session? If re‑authentication is required, what UI or API signal informs the client application? Are there version‑specific differences in this behavior that developers should guard against?

Glitch OAuth token expiration behavior

OAuth token expiration handling shifts in Glitch 2024 release

Neel Byte

0 reputation · 11 Aug 2021, 08:41 UTC

108.2K views0

Goal

Determine the exact behavior of Glitch when an OAuth access token reaches its expiration time.

Constraints and uncertainty

Official documentation describes token issuance and scopes but omits the token lifecycle after expiry.
No explicit mention of automatic token refresh or a mandated re‑authentication flow.
Community reports suggest a manual re‑login is required, yet no official confirmation exists.

Open questions

Does Glitch automatically attempt a token refresh using a refresh token, or does it immediately invalidate the session?
If re‑authentication is required, what UI or API signal informs the client application?
Are there version‑specific differences in this behavior that developers should guard against?

2,148 following

Keep exploring this topic

Socket.IO JWT middleware token expiration handling on reconnection

Investigates whether Socket.IO's JWT middleware re‑validates expired tokens on reconnection and how to test the behavior without production secrets.

Does Android AccountManager automatically refresh expired scoped auth tokens?

Does Android AccountManager auto-refresh expired scoped auth tokens, or must apps explicitly invalidate and re-request them?

Can PyCharm proactively detect expired service credentials before an operation fails?

PyCharm stores service credentials and accepts limited-scope tokens, but does not refresh them automatically. Can expired credentials be detected before an operation fails, or does the IDE only surface errors after authentication attempts?

Can Django REST Framework authentication classes fall back after an expired credential raises AuthenticationFailed?

When DRF authentication classes raise AuthenticationFailed, fallback to later classes stops. How can least-privilege APIs handle expired Basic or Token credentials without blocking the chain?

Key Takeaway

Glitch’s own login relies on HttpOnly session cookies, not OAuth access tokens. The 2024 release did not alter this pattern.

Third‑Party OAuth Tokens

Stored server‑side; Glitch auto‑refreshes via a refresh token when the provider supports it.
If the provider revokes the token, the UI prompts for a manual reconnect.
Tokens placed in a project’s .env file are static strings and do not auto‑refresh.

What to Verify

Open glitch.com in Chrome DevTools → Application → Cookies and inspect the session cookie’s expiration and sliding renewal.
Revoke a GitHub token from the GitHub settings and observe the “reconnect” prompt in the Glitch editor.
Search the 2024 Glitch changelog for any mention of "OAuth" or "token" to confirm no lifecycle change.

Thus, developers should treat Glitch’s session as cookie‑driven and handle third‑party token refreshes on the server side.