Unresolved Behavior: Credential Expiration Handling in Racket Auth Module

Answer the core question first

Racket’s racket/auth module stores an expires timestamp with each credential, but it does not automatically invalidate or purge credentials when that time passes. The expiration check is performed only when the application explicitly calls the module’s helper (e.g., auth:credential-expired?) before granting access. If the check is omitted, expired credentials will be treated like any other valid credential, and require-credentials will simply return a generic 401.

Which release should introduce a standard server‑side expiration API?

Both Racket 8.12 and 9.0 expose the expires field, but neither provides a built‑in hook that automatically rejects expired credentials on every request. A sensible approach would be to add an optional flag to require-credentials (e.g., :check-expiration #t) that internally calls auth:credential-expired? and returns a 403 for expired tokens. Until such an API lands, developers must enforce the check themselves.

Can require-credentials be extended or configured?

Yes. The require-credentials form is a macro that can be wrapped or re‑defined. By creating a thin wrapper that performs auth:credential-expired? before delegating to the original macro, you can distinguish between “invalid” and “expired” credentials and return a more specific HTTP status or log the event. Example skeleton:

(define (require-credentials* guard . body)
  (define cred (auth:current-credential))
  (cond
    [(auth:credential-expired? cred) (auth:forbidden)]
    [(guard cred) (apply guard body)]
    [else (auth:unauthorized)]))

Minimal steps to verify the current behaviour

1. Create a credential with expires set to a timestamp in the past (e.g., 1 minute ago).
2. Store it in the same credential store your application uses.
3. Send a request that would normally be protected by require-credentials.
4. Observe the response: if you receive a 401 without any indication of expiration, the check was not performed.
5. Add an explicit call to auth:credential-expired? in your handler and retry the request. A 403 or a custom error should now appear.

One diagnostic detail that would change the recommendation

Does your application currently call auth:credential-expired? (or an equivalent check) before granting access to protected resources? If not, you should add that check or wrap require-credentials as shown above. If you already perform the check, the module’s lack of automatic enforcement is less of an issue, but you should still consider adding a server‑side cleanup routine to purge expired credentials from memory or persistent stores.