Allow for token expiration time customization

[Dasanko]

There are some cases where heavy data processing forces inactivity for a period longer than 10 minutes, causing the token to expire - some queries rely on other endpoints/microservices themselves. Would it be possible to add a feature allowing the token expiration time to be customized, so that specific users can get varying token durations as appropriate for their use cases? Thanks.

[stevehu]

I have written an RFC for this and want call other team members to discuss the impact. https://github.com/networknt/light-rfcs/blob/master/light-oauth2/0003-customized-token-expiration-per-client.md

@ddobrin @NicholasAzar @chenyan71 what do you think?

[ddobrin]

I think that it it could be a useful feature, and I see it being useful in a larger organization, where multiple applications must be secured, with each having sometimes different requirements.

At my current client, it has not yet been considered a high priority item.