Re: [DISCUSS] SASL reauthentication, session expiry

2022-05-23 Thread András Csaki
Hi, Anyone to discuss this with? I see a potential security issue in there since apparently clients can produce/consume despite having an expired token. I have tried tuning various timeouts to see if eventually they get disconnected to no avail. One more likely case when this happens is when the c

[DISCUSS] SASL reauthentication, session expiry

2022-05-19 Thread András Csaki
Hi Kafka Devs, I'd like to discuss expected behavior and a potential bug with the SASL reauthentication process. I've opened KAFKA-13848 a while back and have a small project to reproduce the problem here: https://github.com/acsaki/kafka-sasl-reauth Briefly explained, OAuth clients remain able t