-
Notifications
You must be signed in to change notification settings - Fork 54
Description
Describe the bug
MQTT clients are not disconnected when their OAuth token expires. The AMQP client sets up an on_expiration callback during initialization that closes the connection when the token expires. The MQTT client has no equivalent, so MQTT clients with expired tokens remain connected indefinitely.
Describe your setup
LavinMQ 2.7.0-rc.1, MQTT client connecting with a short-lived JWT token obtained via OAuth client credentials flow.
How to reproduce
- Connect an MQTT client using a short-lived JWT token (e.g. 60s expiry)
- Wait for the token to expire
- The MQTT client remains connected and can continue publishing/subscribing
Expected behavior
MQTT clients should be disconnected when their OAuth token expires, consistent with AMQP.
Reactions are currently unavailable