Session.expires not being obeyed?

[bitsofinfo]

The session will be rejected by the token auth though because it is expired, but the object is not evicted because there is a difference between expiry and deletion.

With “by the token auth” do you mean it will be auto rejected if the following is implemented?

Meaning that if I set an “expires” epoch on the session object and then it via TykSetKeyData(authHash, JSON.stringify(session)); … on the next request following that “expires” being reached (using “auth tokens” per what you noted below) Tyk will return what exactly, on a call to session = JSON.parse(TykGetKeyData(authHash)).

Will session.status == "error"?

NPM and JSVM, custom basic-auth plugin more details?

I would suggest: Changing your auth mechanism to “Auth Token” and set the location of the token to use the Header x-internal-authorization In your plugin, hash the rawAuthorization string Use the hash as the key for the session (or, if you want to go a step further, use orgID+hash(rawAuthorization)) Add the hash as an x-internal-authorization header Reasoning: Open API’s do not process rate limits or quotas Open APIs, since there is no token, do not collect analytics per user It means you …

Also what does this mean in the logs when I call TykSetKeyData(authHash, JSON.stringify(session));

2017-07-26T14:14:36.171578836Z time="Jul 26 14:14:36" level=warning msg="Incorrect key expiry setting detected, correcting"